What is a PTR record, and how does reverse DNS differ from regular (forward) DNS?

A PTR (Pointer) record maps an IP address back to a name — the inverse of an A record. It's used for logging, spam-filtering, and verifying claims like "I am mail.example.com."

Forward vs reverse:

The clever encoding:

PTR records live in special zones with the IP reversed and a fake suffix:

Looking up 8.8.8.8 reverse:
  Query name: 8.8.8.8.in-addr.arpa
                 ↑↑↑↑↑↑↑↑
                 reversed octets

This reversal preserves DNS's hierarchical structure — IP addresses get more specific left-to-right (8 → 8.8 → 8.8.8 → 8.8.8.8), opposite of domain names (com → google.com → www.google.com).

Why reverse DNS exists:

• Logging — server logs show mail-edge-3.example.com instead of 203.0.113.45
• Anti-spam — mail servers reject mail from IPs without matching forward+reverse DNS
• SSH — sshd does a reverse lookup on connecting IPs (set UseDNS no to disable)
• Traceroute — hops display as names, not just IPs

Try it:

dig -x 8.8.8.8           # explicit reverse query
nslookup 8.8.8.8         # most tools auto-detect reverse syntax
host 1.1.1.1

An example:

nslookup 8.8.8.8 returns a PTR pointing to dns.google — Google's reverse DNS for their public resolver.

Tip: A common mail-deliverability check is "FCrDNS" (Forward-Confirmed reverse DNS) — verify that the PTR points to a name whose A record points back to the same IP. Spam filters reject mail from inconsistent setups.

Go deeper:

• Reverse DNS lookup (Wikipedia) — PTR records, the in-addr.arpa reversal, and why the octets flip.
• Forward-confirmed reverse DNS (Wikipedia) — the FCrDNS consistency check anti-spam filters rely on.