IP to Address Lookup

What is an IP-to-address (reverse DNS) lookup?

A reverse DNS (rDNS) lookup takes an IP address and asks the DNS system what hostname, if any, has been published for it. It is the mirror image of the everyday forward lookup: forward resolution turns example.com into 93.184.216.34 using an A or AAAA record; reverse resolution turns 93.184.216.34 back into a name using a PTR record.

The two directions are configured independently and by different parties. Forward records are controlled by whoever runs the domain; reverse records are controlled by whoever was allocated the IP block — normally your ISP or hosting provider. That is why many addresses have a generic PTR (93-184-216-34.static.example-isp.net) or none at all, and why you often cannot set your own PTR without asking the provider.

How it works under the hood

Reverse lookups use a special DNS tree. For IPv4, the address is reversed octet by octet and placed under in-addr.arpa: 34.216.184.93.in-addr.arpa. For IPv6, each hex nibble is reversed and placed under ip6.arpa. A resolver walks that zone like any other DNS name, and the authoritative server returns the PTR record. Because the .arpa zones are delegated down the same allocation hierarchy as the addresses themselves (RIR → ISP → customer), whoever holds the block controls the answer.

Private ranges such as 192.168.0.0/16 and 10.0.0.0/8 have no public reverse delegation, so a lookup on 192.168.1.100 returns nothing unless your local network resolver is configured to answer for it.

Where reverse DNS actually matters

• Email deliverability. Receiving mail servers check that a sending IP has a PTR record and that the hostname it returns resolves forward back to the same IP. This match is called Forward-Confirmed reverse DNS (FCrDNS); without it, mail is often rejected or scored as spam.
• Log readability. Web-server, SSH, and firewall logs are easier to scan when entries show crawl-66-249-66-1.googlebot.com instead of a bare number.
• Traceroute and diagnostics. The router names shown by traceroute and mtr come from PTR records and often encode the city and carrier, which helps locate where a path breaks.
• Light-touch verification. Confirming a client claiming to be a search-engine crawler really originates from that provider's network.

How to run one

• dig -x 93.184.216.34 +short — the standard way; omit +short to see the full in-addr.arpa query and answer.
• nslookup 93.184.216.34 — available on Windows, macOS, and Linux out of the box.
• host 93.184.216.34 — concise output on Unix-like systems.
• Any web-based IP lookup tool, which runs the PTR query for you alongside WHOIS and geolocation.

If you run the mail or web server behind one of these names, make sure the admin and SSH accounts guarding it aren't the weak link — generate a unique strong password for each instead of reusing one.