Reverse DNS
The lookup that turns an IP address back into a hostname, often the most telling single fact about who operates an address.
Forward DNS turns a name into an address; reverse DNS does the opposite, resolving an address to the hostname its operator has published for it through a PTR record. Not every address has one, but when it does, that name frequently says more than the network registration alone.
The reason it is useful is that operators name their machines by pattern. A hosting provider labels servers by region and instance type, so a PTR record can expose a datacenter address that was trying to look residential. A home connection usually carries its ISP's own naming, which reads very differently. The presence or absence of a record is itself a signal, and detection systems weigh it accordingly.
No single lookup is proof. A PTR record is set by whoever controls the address and can be anything they choose, so it is one input among several, read alongside the network, the geolocation and the address's history rather than trusted on its own.
The naming patterns are what make it so informative in practice, and they are remarkably consistent. Hosting providers label machines for their own operational convenience, so a PTR record often encodes a region, an instance identifier or the provider's own name outright. Consumer connections carry ISP naming that frequently embeds the access technology or the customer's dynamic address in the hostname itself, which reads as residential at a glance.
Absence is a signal too, and a slightly counter-intuitive one. A residential address usually has some hostname because ISPs assign them in bulk. An address with no PTR record at all is not automatically suspicious, but it removes a reassurance that a genuine consumer connection would normally provide.
The one place it is treated as more than a hint is verifying crawlers. The standard method for confirming a visitor really is a search engine bot rather than something claiming to be one is a reverse lookup on the address followed by a forward lookup on the resulting hostname, checking that it resolves back to the same address. Both directions have to agree, which is why simply setting a PTR record cannot fake it.
How HProxy handles it
Where we hold a reverse DNS record for an address we show it on that address's page, because for tracing an IP found in a log it is often the single most specific fact available: no two addresses share a hostname, unlike a network name that covers thousands.
Frequently asked questions
How do I do a reverse DNS lookup?
Any IP lookup service shows the PTR record, and command-line tools do it directly with dig -x or nslookup followed by the address. Our own IP lookup displays it where one exists. Not every address has a record, and the absence of one is itself mildly informative.
Can reverse DNS reveal that I am using a proxy?
It can, and it is one of the cheaper ways. Hosting providers name their machines by pattern, so a PTR record can identify a datacenter address that the network registration alone left ambiguous. Consumer ISP naming looks quite different, which is part of why residential addresses are harder to classify as commercial infrastructure.
Can a PTR record be faked?
Whoever controls the address can set it to whatever they like, so on its own it proves nothing. Verification systems handle this with a forward-confirmed lookup: resolve the address to a hostname, then resolve that hostname back and check it returns the original address. Both directions must agree, which is not something you can arrange for a name you do not control.
Does a proxy have a reverse DNS record?
It depends on the type. Datacenter and ISP addresses usually do, because hosting providers name their machines by pattern, and that hostname is often what gives a datacenter proxy away as hosting infrastructure. Residential exits carry whatever their internet provider assigned, which tends to read as an ordinary consumer connection. A rotating residential pool changes exit per request, so the reverse DNS you would see changes with it rather than being a stable property of your session.
Back to the full glossary.