Reverse DNS lookup (PTR and FCrDNS check)
Check that an IP address has a PTR record and that the name resolves back to the same address (forward-confirmed reverse DNS). Enter a domain to check its mail servers. Mail receivers check this on every connection.
By using these tools you accept the Terms and the Privacy page.
How the reverse DNS check works
The reverse DNS check confirms that an IP address and its hostname point at each other, a test many mail receivers run on incoming connections. Use it when you set up or troubleshoot a mail server, or before you start sending from a new IP.
What each lookup does
The check builds the address’s reverse name, in-addr.arpa for IPv4 (RFC 1035) or ip6.arpa for IPv6 (RFC 3596), and asks for its PTR records. It then looks up the A record (AAAA for IPv6) of up to 10 PTR names per address; the other family is asked only when a name doesn’t match, to explain the miss. Addresses are compared in canonical form, so an IPv6 address written with capitals or extra zeros still matches.
CNAME aliases along the way are followed. When a name matches only through an alias, the result says so, because a PTR should name the canonical host (RFC 2181). When the reverse name itself is a CNAME into another zone, the result notes it as classless delegation (RFC 2317), which is normal for small address blocks.
One check stops after 15 seconds: lookups still unanswered then are marked couldn’t check. After 3 seconds the page counts the lookups answered so far.
How each address is rated
- Forward-confirmed: at least one PTR name resolves back to the address (the iprev test of RFC 8601).
- Not confirmed: there is a PTR, but no name resolves back, or the name isn’t a valid hostname. When a single PTR name doesn’t resolve back, the result spells out the record to add in its zone, such as
mail.example.com. IN A 192.0.2.10. - No PTR record: the reverse name has no PTR at all.
- Couldn’t check: the PTR lookup failed, or a forward lookup failed and no other name matched. That is unknown, not a fail.
Notes that can appear even when it passes
More than one PTR record is flagged, and every name that doesn’t resolve back is listed, because many receivers use only the first name they get back and the order can change between lookups. Keep one.
A name is flagged as generic when it contains the address digits (forward, reversed, zero-padded or in hex) or a label such as dynamic, pool, cable, cust or ftth. The test is narrow on purpose: only address digits and well-known pool words count, so a name like mail.example.com isn’t flagged.
When you check a hostname and its PTR names a different host, the result says so. Pointing the PTR at the name your server announces makes the HELO name, PTR and A record agree.
Domains, hostnames, lists and what to check next
For a domain with MX records, up to 10 mail servers are checked in preference order, with a share of at least 2 addresses per server and 20 in all, IPv4 and IPv6 in turn; an address shared by two servers is checked once. These servers receive the domain’s mail; the ones that send it can differ, so check their IPs too. A null MX (RFC 7505) or a failed MX lookup falls back to the name’s own addresses. For any other hostname, up to 20 of its public addresses are checked, and any that aren’t public are listed as skipped. IPv4-mapped and NAT64 IPv6 addresses are refused, because the IPv4 address inside is the one to check. In the Several IPs tab, entries can be split by new lines, spaces, commas or semicolons, and duplicates are dropped.
To find out who controls an address’s PTR, look up its network in the ASN lookup. Then run the blacklist check on the same IP.
Updated · Maintained by Liviu Tanase
Questions
What is forward-confirmed reverse DNS?
Two lookups that must agree: the IP address’s PTR record gives a hostname, and that hostname’s A record (AAAA for IPv6) must list the same address. Many mail servers reject or penalise senders that fail this check, because it costs a spammer on a hijacked home connection more than it costs a real mail server.
My IP has a PTR but the check fails. Why?
The usual cause is a PTR that points to a hostname whose A record points somewhere else, often a generic name left by the provider or a name in a domain that has since moved. Set the PTR to your mail server’s hostname and make sure that hostname’s A or AAAA record points at the same IP.
No PTR at all: how bad is it?
For a mail server, bad: Gmail and other large receivers treat missing reverse DNS as a strong spam signal, and some reject the connection. For web servers and home connections it usually doesn’t matter. The PTR is set by whoever owns the address block (your hosting provider, cloud console or ISP), not in your own domain’s DNS.
Why is a generic hostname a problem when FCrDNS passes?
Names such as 203-0-113-7.dsl.example.net or ec2-203-0-113-7.compute.amazonaws.com contain the address digits or words like dynamic, dhcp, pool or dsl. Receivers and blocklists such as the Spamhaus PBL use those patterns to spot home and dynamic connections, so mail from them scores worse. A mail server should have a PTR in its own domain, such as mail.example.com.
What should the HELO/EHLO name be?
The forward-confirmed PTR name of the sending IP. Receivers compare the HELO name with the PTR and reject HELO values that are a bare IP, a single word or a name that doesn’t resolve. In Postfix that’s smtp_helo_name (defaulting to myhostname); in Exim, helo_data or primary_hostname.
Can I check a domain, a hostname or several IPs?
Yes. For a domain with MX records, its mail servers are checked: up to 10 by preference and 20 addresses in all. Any other hostname is resolved to its public IPv4 and IPv6 addresses. The Several IPs tab checks up to 20 addresses at once. Private and reserved addresses are refused because they have no public reverse DNS.
Do Gmail and Yahoo require reverse DNS?
Yes. Their sender guidelines require valid forward and reverse DNS for sending IPs: a PTR record whose hostname resolves back to the same IP. This check runs exactly that test. Then check the same IP with the blacklist checker, and the whole domain with the deliverability score.
What if an IP has more than one PTR record?
The check passes when any name resolves back, as receivers that follow RFC 8601 do. But many mail servers use only the first name they get back, and the order can change, so every name that doesn’t resolve back is listed. Keep a single PTR record.
Is anything sent to zerobounce.ai?
No. The lookups go straight from your browser to Cloudflare’s DNS-over-HTTPS resolver, with Google’s as a fallback. A lookup that fails, or gets no answer within 15 seconds, is shown as couldn’t check, never as a pass or a fail.