Reverse DNS Lookup

How a reverse lookup works

01
The address becomes a PTR name
An IPv4 address is written backwards under in-addr.arpa: 8.8.4.4 becomes 4.4.8.8.in-addr.arpa. An IPv6 address is written out in full and reversed one hex digit at a time under ip6.arpa.
02
The PTR record names the host
The owner of the address block publishes the PTR record. It can differ from the forward A or AAAA record, or be missing.
03
The query goes to a public resolver
Your browser sends a DNS-over-HTTPS query for the PTR name to dns.google or cloudflare-dns.com, and shows the answer as it comes back.

How to Look Up Reverse DNS

Enter an IP address

Type or paste an IPv4 address such as 8.8.8.8, or an IPv6 address such as 2001:4860:4860::8888. The short IPv6 form with :: is fine.
Pick a resolver

Leave Google Public DNS selected, or pick Cloudflare. Both answer the same question from their own caches.
Run the lookup

Click Lookup. The page builds the in-addr.arpa or ip6.arpa name and asks the resolver for its PTR record.
Read the result

You see the hostname with its TTL, the name that was queried and the response code. If there is no PTR record, the page says so and shows whether the name does not exist (NXDOMAIN) or is empty.

Common Uses for Reverse DNS

Mail server setup

Before a new server sends mail, check that its address has a PTR record naming your mail host, then confirm that hostname resolves back to the same address.

Reading server logs

Turn the addresses in access logs or firewall logs into the names their owners publish, to see which networks are connecting.

Abuse and spam investigations

A PTR name often shows which provider runs an address. Pair it with the IP Address Lookup and the IP Blacklist Checker before you file an abuse report.

Checking a provider change

After asking your hosting provider to set or change a PTR record, look the address up on both resolvers to see when the new name appears.

Why use a reverse DNS lookup?

A forward lookup turns a name into an address. A reverse lookup asks the opposite question: which name does the owner of this address publish for it? Mail administrators check it before they send from a new server, because many receiving mail servers look at the PTR record of the connecting address. Abuse desks and anyone reading server logs use it to see whose network an address belongs to. This tool builds the reverse name correctly for both IPv4 and IPv6, asks a public resolver over HTTPS, and tells you plainly when there is no PTR record.

Reverse DNS Lookup finds the hostname that the owner of an IP address publishes for it. Enter an IPv4 or IPv6 address and the page builds the reverse name, under in-addr.arpa for IPv4 or ip6.arpa for IPv6, asks a public DNS-over-HTTPS resolver for its PTR record, and shows the hostname with its TTL. When there is no PTR record it says so plainly, and tells you whether the reverse name does not exist (NXDOMAIN) or exists without a PTR record.

Mail administrators use it before sending from a new server, since many receiving servers check the PTR record of the connecting address. To confirm the name points back to the same address, look the hostname up in the DNS Lookup. To see where an address is and which network runs it, use the IP Address Lookup, and to check whether it is listed for spam, the IP Blacklist Checker. After a DNS change, the DNS Propagation Checker compares what two public resolvers return for a domain.

How it compares

On a command line, dig -x 8.8.8.8 or nslookup 8.8.8.8 does the same lookup through your own resolver. This page does it in a browser, through a resolver you name, and spells out the reverse name it queried, which is the step most people get wrong by hand for IPv6.

On this page, the query goes from your browser to dns.google or cloudflare-dns.com. The REST API and MCP tool are a separate path: a call sends the address to FindUtils over HTTPS, which asks the same resolver and returns the result. FindUtils does not store that input, and logs the request without its content.

Tips for Reverse DNS

A PTR record is set by whoever controls the address block, so ask your hosting or cloud provider, not your domain registrar.
Check the result both ways: the PTR name should resolve back to the same address with a forward A or AAAA lookup.
Try both resolvers after a change. Each one keeps its cached answer until its TTL runs out.
An address can have more than one PTR record, but mail servers expect one. Keep a single, specific name for a mail server's address.
NXDOMAIN for a home or cloud address is common and not an error; it only means nobody published a name.

Frequently Asked Questions

What is a reverse DNS lookup?

A reverse DNS lookup finds the hostname published for an IP address. It reads the address's PTR (pointer) record, which lives under a special name built from the address: 8.8.8.8 is looked up as 8.8.8.8.in-addr.arpa, and the PTR record there says dns.google. It is the opposite of a normal DNS lookup, which turns a hostname into an address.

How is the PTR name built for an IPv6 address?

The IPv6 address is first written out in full, as 32 hexadecimal digits with every zero restored, then the digits are reversed and separated by dots under ip6.arpa. For 2001:4860:4860::8888 the name is 8.8.8.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.6.8.4.0.6.8.4.1.0.0.2.ip6.arpa. This tool accepts the short form with :: and builds that name for you, so you do not have to count zeros.

What does "No PTR record" or NXDOMAIN mean?

It means nobody has published a hostname for that address. NXDOMAIN is the response code for a name that does not exist, so the reverse name for the address was never created. A NOERROR answer with no records means the reverse name exists but holds no PTR record. Both are normal for many addresses, especially home connections and cloud addresses whose owner never set a name.

Who sets the PTR record for an IP address?

The organisation that controls the address block sets it: usually your hosting provider, cloud provider or internet service provider, not your domain registrar. Your own DNS zone cannot change it. To set or change a PTR record, use your provider's control panel or ask its support, then check the result here.

Why does reverse DNS matter for email?

Many receiving mail servers check the PTR record of the address that connects to them, and some compare it with the forward record of that hostname. A sending server with no PTR record, or with a generic one, is more likely to have its mail rejected or filtered as spam. Before you send mail from a new server, check that its address has a PTR record naming your mail host.

Can I look up a private address like 10.0.0.1 or 192.168.1.1?

You can, but a public resolver cannot tell you its name. Private, loopback and link-local addresses are only meaningful inside one network, so a public resolver answers NXDOMAIN for them. To find the name of a device on your own network, ask your router or the DNS server inside that network.

Why do Google Public DNS and Cloudflare show different TTLs?

The TTL is the number of seconds a resolver may keep its cached copy of the answer, and it counts down from the moment that resolver fetched the record. Two resolvers that fetched the record at different times show different remaining TTLs for the same PTR record. The hostname itself is the same unless the record changed recently.

Does a PTR record prove who owns an address?

No. Whoever controls the reverse zone can publish any name, including a name in a domain they do not own. A PTR record is more trustworthy when the hostname it names resolves back to the same address, which is called forward-confirmed reverse DNS. Use the DNS Lookup to check the A or AAAA record of the hostname you found, and the WHOIS Lookup to read registration data.

Is the IP address I look up private?

On this page, the IP address is sent from your browser straight to the resolver you pick, Google Public DNS (dns.google) or Cloudflare (cloudflare-dns.com), over HTTPS. It does not pass through FindUtils, and FindUtils keeps no record of it. The REST API and MCP tool are a separate path: a call sends the input you include to FindUtils over HTTPS, where it is processed and the result returned. FindUtils does not store that input, and logs the request without its content.

Run it from code

$ curl -X POST \
  api.findutils.com/api/tools/reverse-dns-lookup/execute \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"ip":"8.8.8.8"}'

$ claude mcp add findutils \
  --transport http https://mcp.findutils.com/ \
  --header "Authorization: Bearer YOUR_API_KEY"
# then call findutils:reverse_dns_lookup

Running a tool needs an API key. Keys are not for sale yet: ask for early access. About API keys

The REST API and the MCP tool are a separate path from this page: a call sends the input you include to FindUtils over HTTPS, where it is processed and the result returned. FindUtils does not store that input, and logs the request without its content.

API reference Add to Claude

How a reverse lookup works

The address becomes a PTR name

The PTR record names the host

The query goes to a public resolver