How to check PTR records with dig

Reverse DNS maps an IP address back to a hostname through a PTR record, which is often the first name visible in mail logs, firewall logs, and abuse reports. Checking that record with dig shows whether an address has a published reverse name before a mail, monitoring, or reputation issue is blamed on the wrong DNS layer.

The dig -x option builds the reverse lookup name automatically, using in-addr.arpa for IPv4 and ip6.arpa for IPv6, and asks for a PTR record in class IN. The answer belongs to the resolver path being queried, so cached TTL values and recent provider changes can differ between resolvers.

A returned PTR name is only a DNS clue. For mail identity or asset inventory, confirm that the name is expected and use a forward lookup when policy requires forward-confirmed reverse DNS; a missing PTR on documentation, private, or other scoped ranges does not mean a public reverse-zone failure.

1. Query the IP address with dig -x.

   $ dig +noall +comments +question +answer -x 8.8.4.4
   ;; Got answer:
   ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35716
   ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
   
   ;; QUESTION SECTION:
   ;4.4.8.8.in-addr.arpa.		IN	PTR
   
   ;; ANSWER SECTION:
   4.4.8.8.in-addr.arpa.	4502	IN	PTR	dns.google.

   -x converts 8.8.4.4 to 4.4.8.8.in-addr.arpa and requests a PTR answer. status: NOERROR plus ANSWER: 1 means the queried resolver returned one matching answer row.

2. Read the hostname at the end of the PTR answer row.

   The fields are reverse lookup owner, TTL in seconds, class, record type, and hostname. In the output above, dns.google. is the reverse name returned for 8.8.4.4.

3. Print only the answer row when the response status has already been checked.

   $ dig +noall +answer -x 8.8.4.4
   4.4.8.8.in-addr.arpa.	4502	IN	PTR	dns.google.

   TTL values can count down in resolver cache, so the exact number may differ between repeated runs.
   Related: How to show short DNS answers with dig

4. Use +short when only the returned hostname is needed.

   $ dig +short -x 8.8.4.4
   dns.google.

   A blank +short result does not show whether the name was missing, the address had no PTR answer, or the query failed. Use the status output when the reason matters.

5. Compare the status when no PTR answer exists.

   $ dig +noall +comments +question +answer -x 192.0.2.55
   ;; Got answer:
   ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 20443
   ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
   
   ;; QUESTION SECTION:
   ;55.2.0.192.in-addr.arpa.	IN	PTR

   NXDOMAIN means the reverse lookup name does not exist from the queried resolver's view. NOERROR with ANSWER: 0 would mean the resolver returned a successful DNS response but no matching PTR answer rows.