What is reverse DNS?

Reverse DNS (rDNS) is a DNS lookup that converts an IP address into a hostname. This is stored in a PTR record. Not every IP has a PTR record configured.

What is a PTR record?

A PTR record is the reverse of an A/AAAA record. Instead of domain → IP, it maps IP → hostname. PTR records are commonly used for mail server validation, logging, and network troubleshooting.

Why does reverse DNS sometimes return nothing?

Many consumer IP addresses have no PTR record set, or they return a generic hostname from the ISP. If you are checking a server IP, you may need to configure rDNS at your hosting provider.

How does reverse DNS help investigate network activity?

Reverse DNS lookup allows you to see which domain name is associated with an IP address. This can be useful when investigating unknown servers, identifying hosting providers or understanding where traffic originates from. Security researchers and network administrators often use reverse DNS during incident analysis.

To see how large-scale attack activity moves across networks globally, you can also explore the Cyber Attack Map, which visualizes aggregated cyber threat telemetry.