Reverse DNS Lookup

In the Second Part of DNS series we would be looking into reverse Lookup,  Reverse DNS as the name suggests is the process of using the DNS  to translate IP addresses to hostnames. Reverse DNS is the opposite of forward lookup, which is used to translate human readable hostnames to IP addresses.

In the case of reverse DNS, the query is similar to forward lookup it travels from the root DNS to the DNS servers of the Regional Internet Registry (RIR), which contains the authoritative information for the RIR-delegated IP block, for example for any query to ip from IP block 202.0.0.0/8  will travel from root to the respective RIR's DNS server then based on the subnet delegation and the authoritative DNS server registered with the RIR for the queried subnet ip it will forward the query to the respective authoritative DNS server.

How this is done?

For all the IP addresses  allocated by Internet Assigned Numbers Authority (IANA) to RIR, RIR also delegates corresponding reverse DNS zones within the centrally administered in-addr.arpa for IPv4 and ip6.arpa for IPv6 as seen in image below.

 

In order to do a Reverse DNS lookup for data that is associated with a certain IP address, one needs to map the IP addresses into the DNS name hierarchy. This means that, as an IP address holder, one have to first configure their zone for reverse lookup in their Authoritative DNS server and then have to request reverse delegation of their zone. The second part is done by creating a domain object in the RIR Database for the subnets owned and pointing it to the Authoritative DNS server hosting the delegated reverse DNS zone file.

It is to be noted that Reverse delegations for IPv4 are based on octet boundaries, or a /8, /16, and /24 reverse zones. For example, if you have been delegated a /22 IPv4 block from RIR, you need to register four /24 reverse zones. 

Reverse delegations for IPv6 are based on the closest 4-bit boundaries. The default prefix size for IPv6 delegations made are a /32 and /48. For example, if you have been delegated a /32 IPv6 block from RIR then you should register a /32 reverse zone.

If your customers have their own reverse DNS servers, you need to manage their reverse delegations from within your DNS name servers by adding NS records for the reverse zones you delegate to your customers.

Mapping IP addresses into the DNS name hierarchy

Incase of IPv4, the mapping of the reverse address space can only happen on "byte" boundaries, i.e. multiples of 8 bits. This means that you should take the four octets – the decimal numbers between the dots - of an IP address range, put them in reverse order and then map them into the in-addr.arpa domain.

For example, an address (A) record for mail.example.com points to the IP address 192.0.2.10. In zone file of the reverse database, this IP address is stored as the domain name 10.2.0.192.in-addr.arpa. pointing back to its designated host name mail.example.com. The resulting PTR record would look like this:

5.2.0.192.in-addr.arpa. 3600 IN PTR mail.example.com.

Incase of  IPv6, it uses the hexadecimal notation on "nibble" boundaries, i.e. multiples of 4 bits. This means you should take the IPv6 address, expand all the zeros, put each hexadecimal number in reverse order and map them into the ip6.arpa domain,  it to noted that though we use colon symbol (:) for the subnet separation in IPv6 we still have to use dot notation in the IPv6 zone file of the reverse database.

For example, the domain name mail.example.com corresponding to the IPv6 address 2001:db8::567:dead  is stored as the domain name d.a.e.d.7.6.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.  pointing back to its designated host name mail.example.com. The resulting PTR record would look like this:

d.e.a.d.7.6.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. 3600 IN PTR mail.example.com.

Let us understand IP allocation and Reverse DNS delegation with following example, IP 8.8.8.8 onle of widely used as public dns server by google is part of the IP block 8.0.0.0/8 allocated by IANA to ARIN (American Registry for Internet Numbers) and further from this, IP block 8.8.8.0/24 is allocated to google. so for the reverse dns records to work google had to create a zone file for block 8.8.8.0 in it's authoritative DNS servers  record pointing to host dns.google.com and then create a "domain object" in ARIN database for IP block 8.8.8.0 pointing back to google's authoritative DNS server for reverse lookup.

Why is Reverse DNS so important?

Reverse DNS is mainly used to track the origin of a website visitor, the origin of an e-mail message, etc. It is usually not as critical as the Forward DNS, visitors will reach the website even without the presence of reverse DNS for the IP of the web server or the IP of the visitor.

However, Reverse DNS is important for one particular application: the e-mail system,Many mail servers on the Internet are configured to reject incoming mail from any IP address that does not have reverse DNS. For those who manage their own mail server, reverse DNS must exist for the IP address from which the outgoing e-mail is sent.

Finally before concluding below are the list of RIR's where we need to create domain record for IP block allocated by respective RIR for reverse DNS resolutions.