Reverse DNS Lookup

If I understand this correctly (and please correct me if I am wrong) reverse DNS works by trying to match an IP address to a domain name, rather than the domain name to the IP address. But how does this work if a single IP address has multiple Domain names associated with it? for instance we host a mail server which has about 35 different domains associated with it. Does a reverse DNS entry have to be made for each domain all associating it with that servers IP address? and if so will the reverse DNS then just pull a list of associated domain names and then match the sending domain to that?

Hi, I can see what you are tying to say/ask and the easiest way maybe for you to go here: http://www.dnsstuff.com/info/revdns.htm
and have a quick read about rDNS as it is not as simple as having a reverse DNS entry listed in your DNS server!

I actually had read that before posting. My question is what about ip addresses that have multiple domains attached to them. like web servers that host more than 1 webpage. or in this case email servers that host more than one email domain. a reverse dns with querey IP address 1.2.3.4 but at that ip address it may be hosting 20 domains, so what does the querey return?

I understand how the look up works if its 1 name 1 ip address. but not 1 ip address for 30 names.

Quote:

---

I understand how the look up works if its 1 name 1 ip address. but not 1 ip address for 30 names.

---

The simple answer is, you can't reverse dns mutliple domains to a single IP. A reverse DNS will always show the domain of the hosting ip.

//EDIT you cannot even connect to a multiple hosted domain via IP since many share that same ip, you have to connect via domain name and domain name only.

Oh I just thought of something, are you trying to reverse dns email or something? That is a different issue. There is more information going back such as the user detail which can be "resovled" to a virutal directory containing the domain and the server can report back the proper domain. But a full on reverse dns will never resolve to anything but the associated ip of the hosting server.

Quote:

---

But a full on reverse dns will never resolve to anything but the associated ip of the hosting server.

---

Unless your ISP maintains control of all RDNS for their netblock.... In that case you ask them to report the RDNS records to the hostname you wish and point all domains MX records to the same host(s).

Quote:

---

Unless your ISP maintains control of all RDNS for their netblock.... In that case you ask them to report the RDNS records to the hostname you wish and point all domains MX records to the same host(s).

---

True but that means something within your own control is actually associated with a server and that introduces differing circumstances. In this case you have the mail server probably at your office and your domain is hosted off site. Therefore the MX record will have a reverse lookup associated with a static IP separate perhaps from your domain name server or www server. If your www server and mail sever on on the same ip that is no problem because you are only reporting a single domain.

//EDIT you can tweak your Reverse DNS response to say anything you want as long as you have an ip address. You won't even need a box hooked up to it. It's just some data you are reporting back. But when mutliple domains, like 30 are hosted on a single box with a single nic card that is not possible without more data or some external ip addresses such as your own internet connection. In the case of mail user data is sent by the mail system for a RDNS lookup and the hosting server uses that data to home in on the virutal server of a particula domain and report back the correct reverse dns entry that will match up.

Nope... My ISP manages the RDNS for it's netblock.... I asked if I could do it... They said yes but I chose to leave it with them anyway. Since they own the netblock their RDNS server is authoritative and will override anything you want to try to do unless they delegate the authority "downwards".

When mailservers etc are checked by other mailservers I'm not entirely sure that the RDNS is a true RDNS query... I think it's more a comparison of sending IP and resolution of that IP to a hostname. I could be wrong but there's a lot of mailservers out there that wouldn't work if the request was a true RDNS request.

yeah it's not a true RDNS querry, well it is meaning it meets RFC requirements. But only if the mail server is hosted on a server with multiple domains, otherwise you just report what you want. The mail server doing the query says here is the ip AND user data. The other server looks at the domain to see if it exists in it's virtual domain structure and then reports back YES or NO on the RDNS ip comparison. Let me dig up something. It's a good read.

Yep.... I think we muddled our way through to the truth... ;)

Even with multiple domains you can still tell it to report an external ip if you like. The MX record doesn't have to even be accociated with the box OR network. It justs has to match up when a querry is made to your root domain. For instance my mail server is not even on the same domain, same city or same network but I report it is. :p

Aren't you the clever one.... :p

so let me see if I got this straight:

instead of the server doing the reverse dns check saying "hey...what is this ip address?" it says "hey...does this name and ip address match?" well...something like that.

In practical terms... Yes.. I think... I just don't _know_ it's a gut feeling...

Say you have a message going from mail server A that is 10.0.100.1 and you are saying this is a message from bubba.com. And itchy.com is reciving it. itchy.com says "what is the reverse dns on 10.0.100.1.?" Whoever owns that ip address has the authorty to enter anything they want into the RDNS record for 10.0.100.1 They own it. It can say blue.com if they want but if they do then forward and reverse records won't match because they don't own the authority for blue.com and reverse lookups on blue.com will always go to the authority for that domain.

but back on track
The authority for bubba.com (in tigers case his block from the ISP) will reply that 10.0.100.1 is mail.bubba.com. If 10.0.100.1 is accociated with multiple servers say bubba.com has a mail server on the ip and orange.com has a mail server on the SAME IP then additional info is needed. itchy.com's mail server will make the lookup with additional info. It will say 10.0.100.1 with a user name of billy is what? And the server with multiple domains will look for the user billy info and find a match and report the domain it is associated with.

here is an example, while not the same scenario is good reading.

http://www.sendmail.org/virtual-hosting.html

Quote:

---

instead of the server doing the reverse dns check saying "hey...what is this ip address?" it says "hey...does this name and ip address match?" well...something like that.

---

It is like, this packet says it is coming from domain A and the ip address is 1.2.3.4.

What is the reverse dns record for 1.2.3.4 say?

if a match of domain A, good. 1.2.3.4 is coming from domain A. If they don't match or their is NO RDNS record, terminate connection and block ip 1.2.3.4.

//EDIT I guess this is a redundant post but simplified. I could have used beer cans instead of ip addresses. It is Bud in a class or Duvel?

In the 17 or so years I have been in the USA...

I'm still trying to decide if Bud is a beer or a joke on all Americans....

My gut says it's a joke... ;)

Laugh it up Tiger, when I was in London it was like 10 bucks a can. Back when a pint of English love was what,2 quid?

Brits secretly love bud. :p You think Bud is a joke? Ever tried Papst Blue Ribbon?

The _landlords_ love it at 2 quid a can.... Jeez... It's the kids thinking they are being cool. It's like some english beers... Bass comes to mind... It's like making love in a punt.... The closest thing to f*sking water.... ;)

Pabst, Schlitz, Coors, (with that _real_ mountain water), etc. etc. etc. The best beer you have here that I have tasted that is commonly available is, believe it or not... Rolling Rock... Yes, I'm a screw up... <LOL>

I like Rolling Rock. Sometimes a light bodied lager hits the spot. But I hang out at Rock Bottom Brewery. Local is the way to go. Just like England sometimes eh?

Rock Bottom????? That doesn't have a "ring" to it...<LOL>

I can't get on with most of those micro-brews... They seem to think that the funkier the taste the better.... Yeah, I really love that Blackcurrant Amber Ale.... :rolleyes:

Give me a nice cold Fosters.... or a nice Labatts Blue... I can _live_ with that... and do!!! ;)

MMM Fosters... 2 for 1, Outback 4 to 6 daily.

rDNS to beer... love it!
Fosters??? Yuck! LOL Even Australians don't drink Fosters!
It was created and marketed by Americans! LOL
GUINNESS ROCKS Warm or Cold ----> A meal in itself!
On a lighter note, YuengLing beer! Americans FIRST brewery! (Good Stuff)

Seriously... If you want to talk _good_ beer you use the word Grolsch... Alas, so difficult to find in quantity on a regular basis.... :(

I kind of live in a beer town. We love our beer. Grolsch is easy to find and you can get the bottles with the old style caps. They are plastic now instead of ceramic but still cool.

Quote:

---

rDNS to beer... love it!

---

It's easy to go off topic when talking beer. Beer and IT go hand in hand. Just look at any 'Con out there. Take a security gathering like ... DefCon. 80 percent of the activities involves the scientific study of the chemical reaction that takes place when water, simple sugars, grains and yeast react to one another and the resultant product of nature slides over the tongue.

Quote:

---

the scientific study of the chemical reaction that takes place when water, simple sugars, grains and yeast react to one another and the resultant product of nature slides over the tongue.

---

Dammit Road.... You just gave me a woody.... Don't ever do that again!!!!!!!! :D

LOL... and he is in school... teacher just asked him to go to the Chalk Board.

rDNS, yes let me see......hhmmmmm Keith's India Pale ale.....nuff said. :drink:

Short Answer:
A reverse DNS lookup should only resolve to one host.

Long Answer:

A reverse lookup is just another zone. In a forward lookup the record that relates an IP address to a hostname is a 'A' or address record. A record that resolves a hostname to IP is a 'PTR' or pointer record. Older DNS servers may not handle multiple 'A' or 'PTR' records, but this is not against RFC and you can do it, but this can cause undesired results if you don't know what your doing. Here's why:
Many newer DNS servers will return the whole list of records, but they also return the records in round-robin order. This means that if you have multiple 'A' records, the whole list may be returned, but the order will differ everytime. Depending on how the OS implements gethostbyaddr() and gethostbyip() you may only recieve the first entry, or you may actually get them all but only use the first. This is useful for load balancing services like a webserver, so clients are spread accross diffrent machine.Like 'A' records, 'PTR' records are also treated round-robin if there are multiples. This means any thing trying to use reverse lookup to verify source on such a host will have a chance of failure that grows with each additional record. (aka 2 records gives you a 50/50 shot). What most people do, is stick to the one 'A' record and one 'PTR' record per host, using a 'CNAME' or cannonical name record which acts as an alias to the true 'A' record. In this way forward and reverse will only return one record yet multiple names can be aliased to the 'A' record and not confuse anything.

-Maestr0

Quote:

---

Originally posted here by XTC46
If I understand this correctly (and please correct me if I am wrong) reverse DNS works by trying to match an IP address to a domain name, rather than the domain name to the IP address. But how does this work if a single IP address has multiple Domain names associated with it? for instance we host a mail server which has about 35 different domains associated with it. Does a reverse DNS entry have to be made for each domain all associating it with that servers IP address? and if so will the reverse DNS then just pull a list of associated domain names and then match the sending domain to that?

---

PTR records must be created from the ISP who assigned you the IP. You can have 35 domains for 1 IP and PTR records that reflects that, but generally, you only need to have a single PTR exist for that IP and the domain associated with it does not matter, what matters is that PTR record exists. This will prevent your mail server from being blacklisted.

And in fact having multiple PTR records defined can break some buggy apps.

If you're worried about mail server stuff, the usual check is:
* Does the connecting IP address have a PTR record? Call that name x.
* If I do a DNS A record lookup on x, do I get the connecting IP address?

If you have both of those right, you should be fine -- the exact name doesn't matter. With my mail server the name in the PTR record is of the form pppnnn-nnn.static.internode.on.net, which has nothing to do with the email domains it handles.