Three queries for three questions
| Source | Input | Answer |
|---|---|---|
| Forward DNS | Hostname | Published A and AAAA addresses returned by a resolver |
| Reverse DNS | IP address | PTR names published in its reverse zone |
| Passive DNS reverse IP | IP address | Hostnames recorded with that A or AAAA value |
The operator of a reverse zone controls its PTR records. A forward hostname and a PTR hostname can differ because separate zones publish them. Neither answer lists every website using an address.
IPv4: reverse the address octets
For IPv4, a PTR query reverses the four address octets and appends in-addr.arpa. The documentation address 192.0.2.10 becomes 10.2.0.192.in-addr.arpa.
dig @1.1.1.1 -x 192.0.2.10
dig @1.1.1.1 10.2.0.192.in-addr.arpa PTRThese commands demonstrate the query syntax with a reserved example address; they do not promise a PTR answer. For an operational check, substitute the public address you are investigating.
IPv6: reverse all 32 hexadecimal digits
IPv6 reverse DNS uses ip6.arpa. Expand the address to 32 hexadecimal digits, reverse their order and separate them with dots, as defined in RFC 3596, section 2.5.
For the documentation address 2001:db8::10, the reverse name is:
0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpaUsing dig -x performs this conversion for you:
dig @1.1.1.1 -x 2001:db8::10Multiple PTR answers and missing answers
A reverse name can have more than one PTR record. RFC 2181, section 10.2 explicitly permits this. Preserve every returned PTR value when comparing the answer with forward DNS; do not assume the first name is the only one.
A successful answer with no PTR data, a nonexistent name, a server failure and a timeout describe different outcomes. Keep the DNS status and resolver with your notes. Missing PTR data does not establish that the address has no A or AAAA associations.
Compare PTR names with observed hostnames
Run a PTR query on the public IP, then query each returned name for A and AAAA records. If a name resolves back to that IP, record that correspondence and when you checked it. It does not establish control of other hosts observed on the address.
Run a passive DNS reverse IP lookup separately when you need names previously recorded against the IP. Reverseips.com groups up to 30 A and AAAA observations by hostname. The source dates bound the returned sample; they are not the time of your current PTR query.
On shared hosting or a CDN, a PTR name may describe network infrastructure while historical forward observations contain unrelated customer names. Keep those associations separate when assessing ownership or current hosting.
Related DNS history tools
DNS Timeline: See the MX, NS, TXT and CNAME records recorded for a root domain, with the date each was first recorded.
IP History: See the IPv4 and IPv6 addresses recorded for a root domain, with the dates of their records.
Profundis DNS search provides record-level searches, filters and exports beyond this free sample.
Documentation addresses
The IPv4 example comes from a range reserved by RFC 5737. The IPv6 example uses the 2001:db8::/32 documentation prefix defined in RFC 3849. Both are illustrative values.
Run a reverse IP lookup · Reverse IP method and limits · Reverse DNS and PTR records · Domains on the same IP address