Reverse DNS (rDNS): Why is it important?

The Domain Name System (DNS) is one of the most important elements of the internet. In fact, it would be far more complicated to use the world’s open computer network without DNS and its combination of name servers. The hierarchical directory system is responsible for managing the addresses of projects on the World Wide Web: When registering a website in the DNS, an entry is created that contains an easily legible domain address as well as the associated numerical IP address. We are therefore able to type in familiar addresses like example.com into the browser and reach the relevant website since these domain addresses are automatically translated into the corresponding IP address by a DNS server in the background. In certain cases, however, it can make sense to take the reverse approach – i.e. to determine the domain address or hostname for a particular IP address. This is called a reverse DNS (rDNS) or reverse DNS lookup. 

What is Reverse DNS?

Reverse DNS (rDNS) is a process that resolves an IP address back to the domain. This is the opposite of how forward DNS works, which associates domain names with IP addresses. A reverse DNS lookup answers one question, “I have an IP address. What is the Fully Qualified Domain Name (FQDN) associated with it?”

When you trigger a reverse DNS lookup, it creates a reverse DNS zone where the DNS PTR record is configured. The resolution system for rDNS is configured similarly to a forward DNS lookup. However, instead of finding the IP address with a domain name, rDNS finds the domain name associated with a given IP address.

How does it really work?

Most websites on the internet can be reached by both the domain name and the IP address allocated to the website’s server. If you enter the IP address 173.194.217.103 into your browser’s address bar, you can access Google’s homepage. Since its domain has a valid rDNS, you can access Google by entering its IP address directly into your browser.

Reverse DNS entries are stored in pointer records (PTR). When reverse DNS lookups are performed, PTR records map IPv4 or IPv6 addresses to the canonical host names. However, if there is no pointer record set up on the web server, the lookup fails.

To ensure that a PTR record is set up for your IP, you might need to contact your internet service provider (ISP). In cases where an ISP provides you with a static IP address, only the provider can point the zone (domain name and IP address) to your DNS server.

Unlike a forward DNS lookup, which doesn’t require a sub-delegation from your ISP, a reverse DNS lookup does not work if your provider does not set up a PTR record. However, some providers allow setting it up within their customer portal.

Benefits and Use Cases

Reverse DNS offers several benefits and use cases, including:

Security and Fraud Prevention

Reverse DNS can help identify the source of network-based attacks, such as DDoS (Distributed Denial of Service) attacks or unauthorized access attempts. By mapping an IP address to a domain name, network administrators can quickly identify the responsible party and take appropriate action.

In the context of email servers, reverse DNS can be used to verify the authenticity of the sending server. By checking the reverse DNS lookup of the connecting IP address, email servers can determine if the server’s domain name matches its IP address. If the reverse DNS lookup fails or points to a suspicious domain, the email server may flag the message as potential spam or reject it altogether.

Server Management and Troubleshooting

Reverse DNS can be a valuable tool for server management and troubleshooting. By performing reverse DNS lookups, system administrators can quickly identify the names of servers or devices associated with specific IP addresses. This information is useful for tasks like network inventory management, configuration validation, and diagnosing connectivity or performance issues.

Geolocation and Content Delivery

Some content delivery networks (CDNs) and online services utilize reverse DNS for geolocation purposes. By mapping IP addresses to domain names, these services can determine the approximate geographical location of users or clients. This information can then be used to deliver localized content, optimize service availability, or apply geolocation-based restrictions.

Why are Reverse DNS Lookups Important?

Reverse DNS entries are most valuable for outbound sending as they influence your email’s deliverability.

rDNS helps add credibility to the IP addresses sending emails and functions as an additional layer of email authentication. It allows you to separate legitimate mail servers from compromised email servers that are sending spam.

Several major mailbox providers such as Google, Microsoft, and Yahoo! will block messages coming from a mail server without valid reverse DNS resolution. Also, some SMTP servers are configured to reject emails when the reverse DNS query does not match the HELO.

However, keep in mind that mailbox providers find more importance in your overall IP address and domain reputation when deciding where your emails should be routed.

The best tools for Reverse DNS requests

Most Linux, Windows, and macOS systems have already an integrated tool with nslookup that allows any requests to be sent to the Domain Name System. You can therefore use this program to execute both standard DNS requests as well as reverse DNS lookups, whereby the local DNS server defined by the provider is contacted by default. But another name server can be defined, if necessary.

Alternatively, you can perform rDNS address requests via the web. There are many online tools available based on nslookup, which allow you to submit DNS server requests directly in the browser. Here are three such solutions:

• MxToolBox: MxToolBox is an online service that provides a range of network diagnostics and lookup tools. While some of these functions are subject to a charge, the reverse DNS check using the SuperTool is always free. To use it, simply select the option “Reverse Lookup” and enter either an IPv4 or IPv6 address.
• WhatIsMyIP.com: Not only can you check your IP address on WhatIsMyIP.com – as the name suggests – you can also execute rDNS requests. Select the “Reverse DNS Lookup” option, type the IPv4 or IPv6 address into the entry field, and press “Lookup”.
• Debouncer: The Debouncer web service is aimed specifically at anyone who wants to check whether their own domain or mail server is on a spam blacklist. For this purpose, the “Reverse DNS check” also allows reverse DNS requests. However, it is only possible to check IPv4 addresses.

Conclusion

Today we learned that reverse DNS is not only a great way to improve your cybersecurity investigations, but also to keep your email in tip-top shape by using the right PTR records.

Performing manual rDNS lookups is fine when you’re focusing on isolated cases. However, when you actually need to investigate a hundred or a thousand IP addresses, this becomes a really slow process that can literally take you hours, or even days in some cases.