Reverse DNS and PTR records explained for mail servers

From address to name

Forward DNS records such as A and AAAA live in a domain’s zone: whoever controls example.com decides that www.example.com points to an address. Reverse DNS needs a different tree, because addresses are not organized by domain name. For IPv4 that tree is in-addr.arpa, and for IPv6 it is ip6.arpa.

To build the reverse name, the address is written backwards. 8.8.8.8 becomes 8.8.8.8.in-addr.arpa, and 203.0.113.10 becomes 10.113.0.203.in-addr.arpa, so that the most general part of the address comes last, as in a domain name. For IPv6, every hexadecimal digit of the full 32-digit address is reversed and separated by dots, which is why IPv6 reverse names are long.

Who controls a PTR record

The reverse zone for an address block is delegated by the regional internet registry to the organization that holds the block, and from there to whoever they choose. For a home or mobile connection that is your provider. For a cloud server it is the cloud provider, which usually lets you set the name in its control panel or on request.

This is why adding a PTR record at your domain registrar or DNS host does nothing: they do not control the reverse zone for your server’s address. Ask the provider that gave you the address, and give them the exact hostname you want.

Forward-confirmed reverse DNS

Anyone who controls a reverse zone can publish any name in it, including a name in someone else’s domain. A PTR name is therefore checked in the other direction: look up the A or AAAA records of that name and confirm that one of them is the original address. When both directions agree, the result is called forward-confirmed reverse DNS, or FCrDNS.

The IPNixa reverse DNS lookup does both steps. It asks Cloudflare and Google for the PTR record, then looks up the returned name and reports one of four states.

Observed lookups

We looked up these public addresses through Cloudflare’s and Google’s DNS-over-HTTPS resolvers on 2 November 2026. Every name resolved back to the original address.

What the examples show

The fourth address was the one returned for Gmail’s inbound mail host, gmail-smtp-in.l.google.com, at that moment. Its PTR name is not under gmail.com but under 1e100.net, the domain Google uses for its server names. A PTR name does not have to match the domain a service is known by; it has to resolve back to the address.

The two resolvers returned the same names with very different remaining cache times. For 8.8.8.8, Cloudflare reported 84,907 seconds and Google 18,566 seconds, because each had cached the record at a different time. After a provider changes a PTR record, the old name can therefore appear for up to the record’s full TTL.

A home connection usually has a generic name generated from the address. A broadband line in Bangkok checked on the same day returned a name of the form ppp-a-b-c-d.revip8.asianet.co.th, where a to d are the digits of the address. Names like this identify the provider and often the connection type, not the subscriber.

Why mail servers need it

Receiving mail servers use reverse DNS as a cheap first check against spam from compromised home computers. Google’s sender guidelines require sending servers to have a valid PTR record that resolves back to the sending address, and other large mailbox providers apply similar checks. Generic names such as the broadband example above are commonly treated as residential and filtered.

1. Choose a hostname for the server under a domain you control, for example mail.example.com.
2. Create an A record, and an AAAA record if the server sends over IPv6, that points the hostname to the server’s address.
3. Ask the provider that owns the address to set the PTR record of that address to the same hostname. Do this for each address the server sends from, IPv4 and IPv6.
4. Make the mail server announce the same hostname in its SMTP greeting (HELO or EHLO).
5. Check the result with the IPNixa reverse DNS lookup until both resolvers show a match, allowing for the old record’s TTL to expire.

What reverse DNS cannot tell you

A PTR name is a label chosen by the address owner. It can be outdated, generic or missing, and it says nothing about who is using a dynamic address today. Use it to identify the network or the server role, not a person. Private addresses such as 192.168.1.10 have no public reverse records, so the lookup skips them.