isitdns? wiki/Records/PTR: reverse pointer
Records

PTR: reverse pointer

An IP address's name, stored in a reverse zone. dig -x <ip> returns it.

Type number12
RFC1035
RDATAA single fully-qualified domain name
Lives inin-addr.arpa or ip6.arpa zones

What it holds#

A single FQDN pointing back from an IP address, the reverse of an A record:

53.100.51.198.in-addr.arpa.   PTR   host1.example.com.

Read backwards: the IP 198.51.100.53 says its name is host1.example.com.

When to use it#

  • Mail. Receiving servers run a forward-confirmed reverse DNS (FCrDNS) check: the PTR target's forward record must point back to the sending IP. Mail from an IP with no PTR, or a PTR that fails this check, is commonly treated as a spam signal. See email-records.
  • Logging. sshd and similar daemons resolve client IPs for logs, but only with UseDNS yes; the default has been no for years (sshd_config(5)).
  • Observability. dnstap and flow-log pipelines commonly enrich records with reverse-DNS names.

When not to use it#

  • For aliasing or load balancing: PTR is one name per IP by convention (see Gotchas).
  • In forward zones, except DNS-Based Service Discovery (RFC 6763), which legitimately publishes PTR under names like _ipp._tcp.example.com to enumerate service instances.

dig example#

Asks which name belongs to the address 1.1.1.2.

 dig @1.1.1.1 2.1.1.1.in-addr.arpa PTR
; <<>> DiG 9.20.11-0ubuntu0.2-Ubuntu <<>> @1.1.1.1 2.1.1.1.in-addr.arpa PTR
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11827
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;2.1.1.1.in-addr.arpa. IN PTR
;; ANSWER SECTION:
2.1.1.1.in-addr.arpa. 119 IN PTR security.cloudflare-dns.com.
;; Query time: 31 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Mon Sep 14 13:45:34 CDT 2026
;; MSG SIZE rcvd: 90

GO NOERROR and one PTR naming the host

NO GO NXDOMAIN, which means the reverse name does not exist

run this query in the dig tool →

what each part of this output means →

example.isitdns.net has no PTR: reverse zones are delegated by the RIR or ISP that owns the address block, not by the forward zone's owner, so a teaching zone cannot publish one. Cloudflare publishes a PTR for 1.1.1.2, used here as a live answer. -x 1.1.1.2 is shorthand dig expands into the same query.

RFC 1035 section 3.3.12 defines the RDATA; section 3.5 defines in-addr.arpa. RFC 3596 section 2.5 defines the ip6.arpa nibble form used for IPv6.

DoH query (HTTPS)#

DoH is DNS-over-HTTPS. The application/dns-json format below is a Cloudflare/Google convention, not part of RFC 8484 itself, which defines only the binary application/dns-message type.

curl -s -H 'accept: application/dns-json' \
  'https://cloudflare-dns.com/dns-query?name=2.1.1.1.in-addr.arpa&type=PTR' \
  | jq .Answer
[
  {
    "name": "2.1.1.1.in-addr.arpa",
    "type": 12,
    "TTL": 110,
    "data": "security.cloudflare-dns.com."
  }
]

The TTL field counts down as the resolver's cache entry ages, so your number will differ run to run.

Gotchas#

  • One PTR per IP, in practice. RFC 1035 allows multiples; tooling expects one. Pick a canonical hostname per IP and stick with it.
  • PTR must be in the right zone. A PTR for 198.51.100.20 lives in 100.51.198.in-addr.arpa. If 51.198.in-addr.arpa exists but 100.51.198.in-addr.arpa was never delegated, resolution stops at the parent and the PTR is invisible.
  • FCrDNS asymmetry. The PTR points to a name; that name's A or AAAA record must point back to the original IP. If forward and reverse disagree, mail filters and security tools treat the host as suspicious.
  • RFC 1918 reverse leaks. A wide-open recursive resolver can forward 192.168.x.x.in-addr.arpa queries to the Internet, leaking internal addressing. RFC 6303 (Locally Served DNS Zones) standardizes an empty zone that answers NXDOMAIN for private reverse space; BIND and Unbound ship it enabled by default. See reverse-dns for the AS112 backstop.
  • Documentation addresses have no reverse zone. RFC 5737 (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24) and RFC 3849 (2001:db8::/32) addresses are not routed. RFC 6303 section 4.2 lists their reverse zones as locally served, so a live PTR lookup against one returns NXDOMAIN from the resolver's own empty zone (verified: 2.1.1.1.in-addr.arpa answers, 53.100.51.198.in-addr.arpa does not). Use these ranges in zone-file examples only.
  • Public reverse not under your control. Reverse DNS for a public IP is delegated by your RIR/ISP, not your zone. Getting a custom PTR for a static public IP usually means asking your ISP.

See also#