IP To Hostname

IP to Hostname: Reverse DNS Lookup

Enter an IPv4 or IPv6 address in IP address or hostname and click Get Hostname. You get the address’s reverse DNS name, a check that the name points back to the same address, and who controls the address’s reverse DNS. The result also gives the network, AS number and location, and a plain-language reading of what the name tells you.

You can also enter a hostname. Every address behind it is then looked up, each with its own reverse DNS.

Example: 8.8.8.8

8.8.8.8 → dns.google, points back to this address. The tool reads it as a Google address whose name follows Google’s own naming. Here’s what each row means:

• Reverse DNS name: dns.google. This is the PTR record, the name attached to the address.
• Points back to this address. Looking up dns.google the normal way gives 8.8.8.8 again, so the name is confirmed. More on why that matters below.
• Lookup name: 8.8.8.8.in-addr.arpa. The name that was actually queried in DNS.
• Reverse zone: 8.8.8.in-addr.arpa, with primary server ns1.google.com and contact [email protected]. This is the DNS zone that holds the address’s PTR record, and it tells you who runs it.
• Network: Google LLC, AS15169. Location: San Jose, California, United States.

So 8.8.8.8 is Google’s public DNS resolver. On its own it’s just four numbers. With the name, network and zone, you know exactly whose server it is and who manages it.

What reverse DNS is

Regular DNS starts with a name and gives you an address. Reverse DNS starts at the other end: you have the address and want to know what it calls itself. That answer is stored in a PTR (pointer) record.

The PTR record isn’t set by whoever runs a website on that address. It’s set by whoever runs the network the address belongs to, usually an ISP, a hosting company or a cloud provider. That’s why a server often has a name here that has nothing to do with the sites it hosts. Some providers name things carefully, like mail.example.com. Others use auto-generated names like 203-0-113-25.dynamic.example-isp.net. Plenty set nothing at all.

How the lookup works

DNS can’t search for an address directly, so the address is turned into a name. For IPv4, the four numbers are written in reverse order and .in-addr.arpa is added. Looking up 8.8.4.4 means asking for 4.4.8.8.in-addr.arpa. (8.8.8.8 is a poor example here because it reads the same both ways.) The tool shows this as the Lookup name.

IPv6 works the same way under ip6.arpa, but the address is written out in full and reversed one hex digit at a time. For 2001:4860:4860::8888, that comes to a 72-character name, which is why nobody does it by hand.

The in-addr.arpa tree is divided into reverse zones, and each one is handed to the organization that holds that block of addresses. The tool reads the zone’s details, its primary nameserver and its contact address, and shows them even when no PTR record exists. That makes it useful even for an address with no name: the zone tells you who could add one.

The network and location rows don’t come from DNS. They come from IP registration and geolocation data, so you get them for every address.

“Points back to this address”

Whoever controls a reverse zone can put any name in it, including googlebot.com or yourbank.com. A PTR record on its own proves nothing.

What they can’t do is make that name point back to their address, because the name’s forward DNS belongs to someone else. So the tool takes the reverse name, looks it up normally, and checks whether the original address is among the results. When it is, the name is forward-confirmed, and you can trust it. When it isn’t, treat the name as a claim, not a fact.

Reading the name

A reverse name often says more than it seems to, and the tool puts it into words. Common patterns:

• The provider’s own naming, like dns.google, or names ending in 1e100.net for Google’s web servers (a 1 followed by 100 zeros is a googol). The address is run by the provider itself.
• The address written into the name, as in 203-0-113-25.dynamic.example-isp.net or names containing pool, dyn, dsl or cable. These are home and mobile connections. Mail from these addresses is widely distrusted.
• Cloud defaults like ec2-…compute.amazonaws.com. This is a rented server that nobody has named, typical for bots and scrapers.
• A custom name like mail.example.com. Someone deliberately named the server, usually a mail server or a company gateway.
• Location codes. Router and server names often contain an airport or city code, such as fra for Frankfurt or lhr for London Heathrow. That’s useful when reading a traceroute.

Looking up a hostname

Enter a name instead of an address, and every IPv4 and IPv6 address behind it is looked up, each with its own reverse DNS. It’s a quick way to see what really serves a domain. A site’s addresses often carry the hosting company’s or CDN’s names, not the site’s own.

What it’s useful for

Checking whether “Googlebot” is really Google

Any scraper can call itself Googlebot in its user agent, and fake Googlebots show up in server logs all the time. Google’s advice is to verify with DNS: look up the address’s reverse name, check that it ends in googlebot.com, google.com or googleusercontent.com, then check that the name points back to the same address.

This tool does both steps in one lookup. Enter the address from your log. If the name ends in one of those domains and the result says points back to this address, it’s Google. If either part fails, it isn’t. Bingbot works the same way, with names ending in search.msn.com.

Getting a PTR record set for your mail server

Mail servers check the reverse name of every address that connects to them. Most distrust or reject mail when the name is missing or doesn’t point back.

Enter your mail server’s address here. If there’s no name, or it doesn’t point back, it needs fixing, and the Reverse zone row tells you who to ask: the primary server and contact show who runs reverse DNS for that address, usually your hosting provider or ISP. You can’t add a PTR record from your own domain’s DNS panel. Many VPS providers let you set it in their control panel.

Afterwards, run the address through IP Blacklist Check.

Figuring out who’s hitting your server

When one address shows up thousands of times in your access logs, its name and network usually tell you what you’re dealing with. It might be a cloud server (where most scrapers run), a search engine crawler, a monitoring service or an ordinary home connection. That’s often enough to decide whether to block it, rate-limit it or leave it alone. ASN Lookup shows the other address ranges that belong to the same network.

Reading traceroutes

Traceroute output is mostly addresses. Looking up the ones without names often turns up location codes that show roughly where your traffic travels.

Spotting company visitors (with low expectations)

Some companies have their own address ranges with names like gw.companyname.com. If one of them visits your site, you’ll see the name. Most visitors, though, come through home broadband, mobile networks or VPNs, so you’ll usually see the provider, not the company.

FAQ

Why is there no hostname for this address?

It has no PTR record. Reverse DNS is optional and up to whoever runs the network, so many addresses don’t have one. The reverse zone, network and location are still shown, and the zone’s contact is who could add a name.

Is the hostname the website hosted on that address?

Usually not. The reverse name belongs to the server, something like server214.hostingcompany.com, not to the websites on it. A shared hosting server can carry hundreds of domains, and reverse DNS only shows the one name the provider chose.

Does it tell me who’s behind an address?

Only which network. You’ll see the provider (an ISP, a mobile operator, a data center) and an approximate location. You won’t see a person’s name, address or account details.

How accurate is the location?

Country and network are reliable. City is an estimate and can be far off, especially for mobile connections and VPNs.

Anycast addresses are a special case. 8.8.8.8 shows San Jose, but Google answers that same address from servers all over the world. The city is a database entry, not where your query was actually handled.

Does it work with IPv6?

Yes. Paste the full or shortened form. 2001:4860:4860::8888, for example, also comes back as dns.google.

Can I do this from the command line?

Yes. On Linux or macOS, run dig -x 8.8.8.8 +short for the reverse name, then dig +short dns.google to check that it points back. On Windows, nslookup 8.8.8.8 does the first step. The tool does both, and adds the reverse zone, network and location.