Reverse DNS & Mail Reputation

Concept

Reverse DNS (PTR records) answers a different question than everything so far: given an IP address, what hostname claims it? FCrDNS (Forward-Confirmed reverse DNS) is the practice of checking that the PTR's claimed hostname, when looked up forward, resolves BACK to the same IP — a consistency check many mail servers use as a spam-filtering signal, independent of SPF/DKIM/DMARC. A mail-sending IP with a missing or mismatched PTR record is treated with suspicion by many receiving systems regardless of how correctly SPF/DKIM/DMARC are configured, because spammers routinely fail this check while legitimate, established mail infrastructure almost always passes it.

Common Misconception

"I control my domain's DNS, so I can fix reverse DNS the same way I fix everything else." Usually not — PTR records are controlled by whoever owns the IP address block, which is typically your hosting or cloud provider, NOT your DNS provider. This is a genuine architectural split that trips people up: forward records (A, MX, etc.) go in your DNS dashboard, but the reverse mapping for the IP itself is a completely different party's responsibility, often requiring a support ticket rather than a self-service change.

Hands-On Exercise

No lab environment needed for the checks themselves:

• marinadns.io/ptr — reverse-lookup any IP directly.
• marinadns.io/reputation — check an IP's or domain's mail reputation standing.
• marinadns.io/bl — blacklist check across common DNSBLs.
• noda.marinadns.io — for the true capstone, run your own domain through a full NODA Check and compare its findings against everything you've manually verified across all 11 lessons. This is the intended closing exercise: confirm your own understanding against the automated report, not the other way around.

For setting up and forward-confirming a PTR record on infrastructure you control (which typically requires your hosting/cloud provider's support flow, not a DNS dashboard), see Lesson 11 in the DNS Admin Course Lab Environment page.

Commands to Run

# Reverse lookup: what hostname does your mail-sending IP resolve to?
dig -x your.mail.server.ip +short

# Forward-confirm: does that hostname resolve back to the same IP? (FCrDNS)
dig +short the-ptr-hostname.example.com A

# Full closing capstone — run every prior lesson's check against your domain in one pass:
dig yourdomain.com A AAAA MX TXT NS SOA CAA +noall +answer
dig yourdomain.com DNSKEY DS +short
dig _dmarc.yourdomain.com TXT +short
dig selector._domainkey.yourdomain.com TXT +short
dig -x your.mail.server.ip +short

# Or, simplest: run the whole domain through NODA itself
# https://noda.marinadns.io — same checks, one consolidated report