7

As I understand it, an IP address-owner can set up a DNS PTR record for his IP address to map the IP addresses to its host names. There are some things about this I don’t understand. I’ve managed other DNS records often using web based interfaces, but never seen PTR records exposed in those.

A DNS record of type CNAME or A is stored in the DNS zone for a specific domain such as example.com. Are the PTR records pointing at example.com typically stored in the same zone or are they stored in separate zones? If the PTR record is stored in the same zone as as example.com, how does other servers know to query this zone for the PTR record?

What stops me from adding a PTR record saying that <ip-address-of-my-server> resolves to, say, gmail.com? If I manage the PTR records for my IP address, shouldn't I be able to add anything?

Improve this question

2 Answers 2

Reset to default
8

or are they stoerd in separate zones?

Separate zones, one per old C network (last byte in the octet).

What stops me from adding a PTR record saying that resolves to say gmail.com?

Nothing. But as this is not used exceptt for nice pings or some email validity checks, you achieved nothing. people will still go to gmail when they type in gmail.com. All people now see is gmail.com in a traceroute, nothing else.

The one real use for this is smtp - the HELO string given in SMTP should match the PTR record name given. Basically the server must say it is who the ptr record says it is. Note that it can still accept emails for other domains.

Improve this answer
3
  • So I take it that relying on it being correct may be a bad idea. For instance, say I want to make sure only server.example.com can access my web service. When a client connects to my web service I only have its IP address. I could do a DNS/PTR lookup and then see whether the IP-address matches server.example.com and only in that case let it call my code. But as I understand you now, this would pretty much make it possible for anyone to call my service, as long as they add the correct PTR record.
    – Martin
    Commented May 18, 2011 at 9:48
  • @Martin: Once you've done the reverse lookup you could do a forward lookup. This should match the original IP. If not something dodgy could be going on. e.g. IP address 1.2.3.4 resolves somehost.com. If somehost.com does not resolve to 1.2.3.4, then the PTR could be fake.
    – qbert220
    Commented May 18, 2011 at 10:44
  • 1
    No, you should NOT. the PTR will map normally to the host name, NOT the domain name you use. A computer can host multiple domains, or a domain be on many computers. Expect the PTR to resolve to the COMPUTER name, not the domain name you connected to. For example, I hsot some domains for customers, and PTR will show www-0001 or www-0002, depending on what computer hosts the domain.
    – TomTom
    Commented May 18, 2011 at 10:59
1

If you have a zonefile for example.com with:

www.example.com  300  IN  A  16.24.32.40

Then you would have a zonefile for 32.24.16.in-addr.arpa with:

40.32.24.16.in-addr.arpa  300  IN  PTR  www.example.com
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .