Reverse DNS Lookup
Enter an IPv4 or IPv6 address to get the hostname its PTR record names and where that name came from, beside what our datasets say about the address itself: VPN, proxy, Tor, relay or hosting. Every answer links to the full report for its address.
How reverse DNS works
Forward DNS turns a hostname into an address. Reverse DNS goes the other way: the address is written backwards under a domain kept for the purpose, and the PTR record found there names the host. IPv4 lives under in-addr.arpa, one label per octet; IPv6 under ip6.arpa, one label per hex digit, all 32 of them written out.
203.0.113.77.113.0.203.in-addr.arpa2001:db8::77.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpaWhoever runs the reverse zone for an address writes its PTR record: the network it belongs to, or a customer that network has handed the zone to. Nothing requires one and nothing checks it. Many addresses have none, and a name need not lead back to the address it came from; one that does is called forward-confirmed.
This tool reads our IP RDNS snapshot first: the PTR records our scans last saw across the address space, refreshed weekly. For an address the snapshot does not hold, it asks DNS directly and keeps the answer for up to an hour. Each result says which of the two answered.
What a hostname gives away
Unless a network hands the zone to its customer, the PTR record is the network's to write, so the name says whose network an address is on before it says anything else. Many cloud and hosting providers name servers under their own domains, as in Amazon EC2's ec2-3-80-0-5.compute-1.amazonaws.com, and many consumer ISPs name subscriber lines the same way, with the address spelled out and a word like res, cable or dynamic beside it.
So a hostname can tell a server from a subscriber at a glance. VPN exits run on servers, and an exit's PTR record can carry the name of the company hosting it, whichever VPN brand sells the connection; some VPN operators name their servers under their own domain instead.
It is a hint, not proof. The name is whatever the zone's owner wrote, and the proxies hardest to catch look the most ordinary: a residential proxy exit is someone's home connection, so its name reads like any subscriber's. That is why every lookup here shows the verdict of our eight datasets beside the name, and links to the full report for the address.
Common questions
What is a reverse DNS lookup?
An ordinary DNS lookup run backwards: it starts from an IP address and asks for the hostname that address points to. The answer is a PTR record, kept under in-addr.arpa for IPv4 and ip6.arpa for IPv6.
Why does an address have no PTR record?
Nothing requires one. The network an address belongs to decides whether to publish a name for it, and many never do. No PTR record means DNS has no name for the address, not that nothing is using it.
Where does the hostname come from?
From our IP RDNS snapshot when it holds the address: the PTR record our scans last saw, refreshed weekly. Otherwise from a live PTR query made for the lookup, whose answer is kept for up to an hour. Each result says which one answered.
Does a hostname prove an address is a VPN?
No. A PTR record says whatever the owner of its zone wrote, and nothing checks it. A hosting company's name is a strong hint that an address is a server; the verdict beside it is what our eight datasets say about the address itself.
Is there a limit?
Lookups here are free and need no account. Each one counts toward the same hourly allowance as every other lookup on this site: past it you are asked to confirm you are a person, and later refused until the hour is up. The example addresses cost nothing, and an API key has no such limit.
Start without signing up.
Paste it into a terminal. No account needed. 1k daily allowance per user, answering ip and is_vpn.
{"ip": "45.83.91.1","is_vpn": true}