When troubleshooting a Linux server, you often start with an IP address rather than a hostname.

For example, you may see an address like:

192.168.1.100

and want to know which hostname it belongs to.

This is where a reverse DNS lookup comes in.

A reverse DNS lookup takes an IP address and looks for the hostname associated with it. Unlike a normal DNS lookup, which resolves a hostname to an IP address, reverse DNS works in the opposite direction.

In Linux, you can perform a reverse DNS lookup in several ways. In this guide, we’ll focus on two commands that are commonly available on Linux systems:

1. dig
2. host

---

What Is a Reverse DNS Lookup?

A normal DNS lookup looks like this:

hostname → IP address

For example:

www.example.com → 93.184.216.34

A reverse DNS lookup works in the opposite direction:

IP address → hostname

For example:

See also: Mastering the Linux Command Line — Your Complete Linux Training Course

93.184.216.34 → example.com

Reverse DNS normally uses a special DNS record called a PTR (Pointer) record.

For an IPv4 address such as:

192.0.2.10

the reverse DNS name is constructed as:

10.2.0.192.in-addr.arpa

The DNS server can then return a PTR record containing the hostname.

---

Method 1: Perform a Reverse DNS Lookup with dig

dig is one of the most useful DNS troubleshooting tools available on Linux.

The basic syntax is:

dig -x IP_ADDRESS

For example:

dig -x 8.8.8.8

You may see output similar to:

; <<>> DiG 9.18.x <<>> -x 8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12345
;; flags: qr rd ra; QUERY: 1, ANSWER: 1

;; QUESTION SECTION:
;8.8.8.8.in-addr.arpa.    IN    PTR

;; ANSWER SECTION:
8.8.8.8.in-addr.arpa.  300  IN  PTR  dns.google.

;; Query time: 20 msec
;; SERVER: 192.168.1.1#53
;; WHEN: Wed Sep 23 14:00:00 2026
;; MSG SIZE  rcvd: 72

The important part is:

;; ANSWER SECTION:
8.8.8.8.in-addr.arpa.  300  IN  PTR  dns.google.

This tells you that the PTR record for 8.8.8.8 is:

dns.google.

What Does -x Mean?

The -x option tells dig to perform a reverse DNS lookup.

Instead of manually constructing the in-addr.arpa name, you can simply run:

dig -x 8.8.8.8

and dig handles the reverse lookup format for you.

---

Get Only the Hostname

The normal dig output contains a lot of information.

If you only want the PTR result, use:

dig -x 8.8.8.8 +short

Output:

dns.google.

This is especially useful in scripts.

For example:

hostname=$(dig -x 8.8.8.8 +short)
echo "$hostname"

You might get:

dns.google.

If you don’t need the trailing dot, you can remove it:

dig -x 8.8.8.8 +short | sed 's/\.$//'

Output:

dns.google

---

Query a Specific DNS Server

By default, dig uses the DNS resolver configured on your Linux system.

You can also specify a DNS server manually.

For example:

dig @8.8.8.8 -x 1.1.1.1

Here:

@8.8.8.8

means:

Send the DNS query to the DNS server at 8.8.8.8.

The -x option tells dig to perform the reverse lookup.

This can be useful when troubleshooting DNS problems.

For example, if your configured DNS server isn’t returning the expected result, compare it with another resolver:

dig @192.168.1.1 -x 8.8.8.8

and:

dig @8.8.8.8 -x 8.8.8.8

The results can help determine whether the problem is with your local DNS resolver or with the DNS data itself.

---

Method 2: Perform a Reverse DNS Lookup with host

The host command provides a simpler interface for DNS lookups.

The syntax is:

host IP_ADDRESS

For example:

host 8.8.8.8

You may see:

8.8.8.8.in-addr.arpa domain name pointer dns.google.

The important part is:

domain name pointer dns.google.

The PTR record points to:

dns.google.

Compared with dig, the output is much shorter.

This makes host convenient when you simply want to check the hostname associated with an IP address.

---

dig vs host

Both commands can perform reverse DNS lookups, but they serve slightly different purposes.

Command	Example	Output	Best for
dig	dig -x 8.8.8.8	Detailed DNS information	DNS troubleshooting
dig +short	dig -x 8.8.8.8 +short	PTR result only	Scripts and quick checks
host	host 8.8.8.8	Simple result	Quick lookups

If I’m troubleshooting DNS, I normally reach for dig.

If I just want a quick answer from the command line, host is often easier to read.

---

IPv4 Reverse DNS

IPv4 reverse DNS uses the:

in-addr.arpa

DNS domain.

For example:

192.168.1.10

becomes:

10.1.168.192.in-addr.arpa

The octets are reversed.

You can see this directly with:

dig -x 192.168.1.10

The query section will contain something similar to:

10.1.168.192.in-addr.arpa. IN PTR

You normally don’t need to construct this name yourself because dig -x does it automatically.

---

IPv6 Reverse DNS

IPv6 reverse DNS works differently.

Instead of in-addr.arpa, IPv6 uses:

ip6.arpa

For example:

dig -x 2001:4860:4860::8888

You can also use:

host 2001:4860:4860::8888

The underlying reverse DNS name is much longer because IPv6 addresses are represented using hexadecimal nibbles in reverse order.

Again, the tools handle this conversion for you.

---

What If There Is No PTR Record?

A reverse DNS lookup does not always return a hostname.

For example:

dig -x 192.0.2.123

may return:

;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN

This means the DNS server indicates that the queried reverse DNS name does not exist.

You may also see a response with no answer section.

For example:

;; ANSWER: 0

This doesn’t necessarily mean that the IP address is unreachable.

It simply means that there isn’t a usable PTR response from the DNS system you queried.

This distinction is important:

No PTR record

does not mean:

The IP address is invalid

and it does not necessarily mean:

The host is down

---

Reverse DNS Does Not Prove Who Owns an IP

Suppose you run:

dig -x 8.8.8.8 +short

and receive:

dns.google.

This tells you what the DNS infrastructure returns for the PTR query.

It does not mean that reverse DNS is a security mechanism that independently proves the identity of the host.

This is particularly important when reverse DNS is used in security or access-control systems.

A PTR record is DNS data controlled by the relevant IP address holder or DNS infrastructure. Treat it as DNS information, not as cryptographic authentication.

---

Reverse DNS in Linux Troubleshooting

Reverse DNS is particularly useful when troubleshooting logs.

For example, you might have an application log containing:

Connection received from 10.20.30.40

You can check the reverse DNS entry with:

dig -x 10.20.30.40 +short

or:

host 10.20.30.40

If the DNS infrastructure has a PTR record, you may get:

db01.example.com.

You can then investigate the hostname instead of working only with the IP address.

---

Common Commands Cheat Sheet

Reverse lookup with dig

dig -x 8.8.8.8

Show only the PTR record

dig -x 8.8.8.8 +short

Reverse lookup with host

host 8.8.8.8

Use a specific DNS server

dig @8.8.8.8 -x 1.1.1.1

Reverse lookup an IPv6 address

dig -x 2001:4860:4860::8888

---

Frequently Asked Questions

What is reverse DNS?

Reverse DNS maps an IP address to a hostname. It normally uses a PTR record.

The normal direction is:

hostname → IP

Reverse DNS is:

IP → hostname

What DNS record is used for reverse lookups?

Reverse DNS uses a PTR record.

IPv4 reverse DNS uses:

in-addr.arpa

IPv6 reverse DNS uses:

ip6.arpa

Which command is better, dig or host?

Both work.

Use:

dig

when you need detailed DNS information or are troubleshooting DNS.

Use:

host

when you want a quick, human-readable result.

For scripts, this is particularly convenient:

dig -x IP_ADDRESS +short

Why does reverse DNS sometimes return nothing?

The IP address may not have a PTR record, or the DNS server you’re querying may not have access to the relevant reverse DNS information.

Check the response with:

dig -x IP_ADDRESS

rather than relying only on the short output.

Can I use reverse DNS to verify an IP address?

Reverse DNS can provide useful hostname information, but it should not be treated as authentication.

A PTR record tells you what the DNS system reports for that IP address. It does not cryptographically prove the identity of the machine.

---

Final Thoughts

Reverse DNS is a small but useful Linux networking skill.

If you have an IP address and want to know whether it has an associated hostname, start with:

dig -x IP_ADDRESS +short

For example:

dig -x 8.8.8.8 +short

For a quick lookup, you can also use:

host 8.8.8.8

Once you understand PTR records, in-addr.arpa, and ip6.arpa, reverse DNS becomes much easier to troubleshoot.

For Linux administrators, these commands are especially useful when investigating server logs, network connections, firewall events, and DNS problems.