Reverse IP Lookup

About this reverse ip lookup

Reverse DNS works backwards from a normal lookup: instead of asking which address belongs to a name, it asks which name belongs to an address. The answer is stored in a PTR record in a special zone, in-addr.arpa for IPv4 and ip6.arpa for IPv6. Mail servers, security tools and log analysers read it to label a connection with something more readable than a number.

For each name found, this tool also checks the forward direction. If the hostname resolves back to the same address, the pair is called forward-confirmed, which mail systems treat as a sign of a properly configured server. A missing or mismatching record is common on home connections and small servers and can cause mail to be rejected.

Be aware of one limit. Many people search for every website hosted on one IP, but that list needs a large passive DNS database that this free tool does not have, so it only shows the PTR names the owner published. The address you type is sent to our API at /api/reverse-ip-lookup.php and looked up from our server. Private and local addresses are refused.

Which controls should I check first?

The Reverse IP Lookup form labels its controls as IP address or domain. Use those labels to keep the source and settings separate. A sample argument that selects a mode is not additional source text. Choose the setting matching your intended operation before copying a result, and change it explicitly when comparing another mode. The labels describe what this form accepts; the worked examples below demonstrate only the stated supplied values.

How should I interpret this specific operation?

A reverse result concerns the queried address and the lookup method described above. A PTR name is not a complete inventory of websites sharing that address. A web host can serve many domains without listing them through reverse DNS, and a proxy address can front unrelated origins. Treat a returned label as a naming clue, not evidence that the domain owns every service reachable through that address. An absent PTR record can be normal for a public web endpoint.

Worked helper values

These values come from the reproducible calculation examples supplied with this tool. Each row identifies the complete supplied arguments and the returned value. A visible ↵ denotes a line break and ⇥ denotes a tab in text examples. Settings appear alongside source data so that a different mode is not mistaken for an identical input. These are helper calculations, not observations of a live device, fetched target, image decoder, browser preview or downloaded file. Use the stated method above to relate the returned fields to the actual operation.

Whose network view does this result represent?

A server-side check observes the target from the checking service's network location. Your browser, a mobile connection and another resolver can see different answers because of caching, geolocation, routing, filtering or load balancing. Keep the exact queried target and the time of your check when comparing observations. A timeout means this attempt did not obtain a result within its limit; it does not prove the target is unavailable everywhere. To investigate a discrepancy, compare the same target and protocol from the relevant client environment as a separate step.

How should I prepare a target?

Use a public target whose spelling and scope you can explain. A hostname, an IP address and a complete URL carry different information. A URL includes a scheme, path and possibly a query string, while a hostname identifies a host without those request details. Follow this page's stated input convention and omit credentials or confidential query values from demonstration targets. Correct an invalid-target message before retrying. The address is sent to the checking service for processing, so this workflow is different from a local parser that merely splits the supplied text into components.

What can I infer from missing fields?

A missing field can reflect the target, the available response or the check's scope. It should not be replaced with a guessed value. Read any status or explanation beside the output and distinguish an empty answer from an error. Compare the same type of evidence across repeated checks rather than treating every field as an independent verdict. A registration record, resolver result and HTTP response describe different layers and can disagree without any of them being fabricated. Follow a discrepancy to the layer it concerns before changing DNS, application settings or certificate configuration.

How can I document a reproducible observation?

Record the exact input, result fields that matter, and any timeout or error text. If the target is a URL, preserve the path and protocol because checking the homepage can differ from checking a specific resource. When a value appears to change, repeat a narrowly scoped check and compare the complete response, including intermediate context if the tool exposes it. Avoid attributing a difference to a named provider or person based only on one field. These outputs are observations from a limited check, not a record of ownership or an exhaustive audit of every configuration on the target.