Reverse DNS query of public IP returns localhost

domain-name-systemipptr-recordreverse-dns

I'm seeing this unusual behavior with reverse DNS lookups on this public IP Address: 222.253.228.79. Can someone explain what's going on?

MXToolbox PTR lookup resolved localhost as the domain

ping -a is even stranger; it resolved it to my local PC name (clifford):

ping -a 222.253.228.79
Pinging clifford [222.253.228.79] with 32 bytes of data:

nslookup via Google's public 8.8.8.8 DNS server also resolves it to localhost:

nslookup 222.253.228.79 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Name:    localhost
Address:  222.253.228.79

Best Answer

Quite simply, that appears to be what the PTR record is configured to point to. Took a look at mxtoolbox as well and it concurs that it is indeed the returned record.

My guess is it is a default setting for the IP's in that range as .78, and .77 also return localhost. Unless you are specifically trying to do reverse lookups on the IP for some need (In which you should contact them and ask them to update their PTR record) then you can chalk it up to an improper configuration.

Related Solutions

Windows – What’s the command-line utility in Windows to do a reverse DNS look-up

ping -a w.x.y.z

Should resolve the name from the IP address if the reverse lookup zone has been set up properly. If the reverse lookup zone does not have an entry for the record, the -a will just ping without a name.

Does a PTR record prove anything about the sender’s email domain

To answer your new question first: No, PTRs don't tell you anything about the sender's domain. See below for the explanation.

Now back to your original question:

Receiving mail servers check none, one, many or all of the following:

Is the HELO name equal to the hostname (A record)?
Is PTR of the IP equal to the A record of the hostname (hostname ==(PTR)==> IP ==(A)==> hostname)?
Is the IP part of the provided SPF record?
Does the sender's domain have at least one MX record? Which doesn't have to match IP/hostname.

Receiving mail servers that check if the sending server is also the MX server are badly configured and should be eliminated from the Internet.

Edit: The PTR does absolutely prove nothing about the email domain. It is never meant to prove this. There are thousands of domains hosted at Google, Amazon, AOL and others. But none of them match the hostname or PTR of Google, Amazon, AOL and others. They all have the servernames of the providers. And there is nothing bad about that.

The PTR only proves the identity of the server but not the identity of the hosted domains. Point.

2nd Edit: A good example for a working environment would be

HELO = mail.example.com
hostname = mail.example.com
A record of mail.example.com = 172.20.25.25
PTR of 172.20.25.25 = mail.example.com
Domains hosted on this server/system = example.com, *.example.com, *.example.net, *.example.org, mycompany.invalid and many many more.
SPF records of hosted domains (optionally) = v=spf1 a:mail.example.com -all
MX record of hosted domains can be anything. E.g. mx1.example.com, mx2.example.com, mailfilter.anti-spam-corp.invalid, mail.example.com, postini.google.invalid, ...

Best Answer

Related Solutions

Windows – What’s the command-line utility in Windows to do a reverse DNS look-up

Does a PTR record prove anything about the sender’s email domain

Related Topic