A PTR record answers the question "what is the name of this IP address?". It is the reverse of the A record you already know. An A record says mail.example.com lives at 203.0.113.10. The PTR record says 203.0.113.10 is called mail.example.com.

For a website, nobody cares. For email, it matters a lot. Most receiving mail servers look up the PTR record of every server that connects to them, and Gmail refuses mail from IPs that do not have a proper one.

How reverse DNS works

DNS can only look up names, so reverse lookups use a trick: the IP address is turned into a special name.

For IPv4, the four numbers are reversed and .in-addr.arpa is added:

203.0.113.10  →  10.113.0.203.in-addr.arpa

The PTR record lives at that name. The order is reversed because DNS reads names from right to left, from the most general part to the most specific. Reversing the IP puts the network first, so each part of the address space can be handed to whoever owns it.

IPv6 does the same thing with every hexadecimal digit, under .ip6.arpa. The address 2001:db8::10 becomes a name with 32 single-digit labels. You never have to type it by hand: tools build it for you.

The important consequence: the reverse zone of an IP belongs to whoever owns the IP, not to whoever owns your domain. Your registrar and your DNS host (Cloudflare, Route 53, OVH DNS…) cannot change it. Your hosting company or internet provider can, because they hold the IP range.

Why mail servers check it

Spam has long come from machines that were never meant to send mail: infected home computers, servers rented for an hour, misconfigured devices. Those machines rarely have a meaningful reverse DNS name. A proper mail server usually does.

So receivers apply a simple test, called forward-confirmed reverse DNS (FCrDNS):

  1. Look up the PTR record of the connecting IP. It should return a name.
  2. Look up the A (or AAAA) record of that name. It should return the same IP.

If step 1 fails, the IP has no name at all. If step 2 fails, anyone could have written that name in their reverse zone, so it proves nothing. Gmail rejects both cases with 550 5.7.25, and other providers count it against you even if they accept the message.

The test is cheap and hard to fake, because a spammer would need control of both the IP's reverse zone and the domain's forward zone.

How to look up a PTR record

The fastest way is our reverse DNS lookup. Enter an IPv4 or IPv6 address and it shows the PTR name, the address that name points back to, and whether the two match.

From a terminal:

dig -x 203.0.113.10 +short

or on Windows:

nslookup 203.0.113.10

Then check the name the other way round:

dig mail.example.com +short

If the second command returns the same IP you started with, the reverse DNS is forward-confirmed.

Not sure which IP to check? It is the address your mail actually leaves from, which is not always the IP of your website. Send a message to a Gmail address, open its headers (our guide to email headers shows how), and find the Received line written by Google. The IP in square brackets is the one Gmail checked.

What a good PTR record looks like

  • It exists, for every IP that sends mail. That includes the IPv6 address if your server has one: many mail servers use IPv6 whenever the other side supports it, and Gmail does.
  • It points back to the same IP through an A or AAAA record.
  • It uses a name on a domain you control, such as mail.example.com or mx1.example.com.
  • It matches the name your server uses in its SMTP greeting (HELO/EHLO). Not strictly required, but filters like it.
  • There is only one. An IP can technically have several PTR records, but you cannot choose which one a receiver uses, so extra records only add uncertainty.

What about the default name your host gives you, like ip-203-0-113-10.provider.net or vps12345.host.example? It usually passes the forward-confirmed test, so Gmail accepts it. But names that contain the IP's numbers, or words such as dynamic, dsl or pool, look like home connections to many spam filters. Replacing it with your own name costs five minutes and removes the doubt.

Where to set it at common hosts

The setting is almost always in your hosting control panel, under a name like "reverse DNS", "rDNS" or "PTR". Most hosts first check that the name you enter already points to the IP, so create the A record first, wait a few minutes, then set the PTR.

  • OVHcloud: in the control panel, go to the IP section, find your IP and choose to modify its reverse. OVH refuses names whose A record does not point to that IP yet.
  • Hetzner Cloud: open the server, then the Networking tab. Each IPv4 and IPv6 address has an editable reverse DNS entry.
  • DigitalOcean: the PTR is set from the Droplet's name. Rename the Droplet to a full hostname such as mail.example.com and the PTR follows.
  • AWS EC2: reverse DNS is available for Elastic IP addresses. Select the Elastic IP, then Actions and Update reverse DNS. AWS also restricts outgoing port 25 by default, which is a separate request.
  • A home or office internet connection: most consumer providers will not set a custom PTR at all. Sending mail directly from such a connection is a bad idea anyway; use your provider's relay or an email service.

If you send through Google Workspace, Microsoft 365, Mailjet, Brevo, Amazon SES or another email service, you do not need to do anything. Their sending IPs already have correct reverse DNS. PTR records only become your job when you run your own mail server, on a VPS or a dedicated IP.

How long changes take

The provider's reverse zone usually updates within minutes. Resolvers that already cached the old answer keep it until its TTL expires, often one hour and at most a day. If our lookup shows the new name but a receiver still complains, wait for the TTL and try again.

Frequently asked questions

Can I add a PTR record in Cloudflare or at my domain registrar?

Not for an IP you rent. A reverse zone can only be edited by whoever holds the IP range. Cloudflare can host reverse zones, but only for IP blocks you own yourself.

Does every server need a PTR record?

Only servers that send email directly to other mail servers really need one. A web server that sends no mail, or a server that hands all its mail to an email service, can live without it.

Does a PTR record help my website's SEO?

No. Search engines do not use reverse DNS for ranking.

My PTR record is correct and Gmail still rejects my mail. Why?

Check IPv6 first: your server may be connecting over an IPv6 address that has no PTR. Then check that the PTR name has an AAAA record if the IP is IPv6, not only an A record. If both are fine, the rejection is about something else. Read the full error text; our guide to SMTP bounce codes lists the common ones.

Sources