Setting Up Reverse DNS (PTR) Record: Email and Security

Setting Up Reverse DNS (PTR) Record: Email and Security

Reverse DNS (rDNS) is the DNS mechanism that translates an IP address into a domain name. While normal DNS translates a domain name to an IP, reverse DNS does the opposite. Also known as a PTR (Pointer) record, this mechanism is critically important for email servers and security systems.

What is a PTR Record?

A PTR record specifies which domain name an IP address belongs to. For example:

# Normal DNS (Forward DNS)
example.com.  →  203.0.113.50

# Reverse DNS (PTR)
203.0.113.50  →  mail.example.com

PTR records are stored in the special in-addr.arpa DNS zone:

# PTR record for 203.0.113.50
50.113.0.203.in-addr.arpa.  IN  PTR  mail.example.com.

# For IPv6 (ip6.arpa)
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.  IN  PTR  mail.example.com.

Why is a PTR Record Important?

Email Deliverability

Email servers verify the PTR record when checking whether incoming messages are spam. Emails from IPs with no PTR record or misconfigured PTR records:

• End up in the spam folder
• Are rejected (bounced)
• Get blacklisted

Major email providers (Gmail, Outlook, Yahoo) typically reject emails from servers without PTR records.

Security and Authentication

• Network security tools: IDS/IPS systems use PTR records to identify IPs.
• Log analysis: Domain names appear in server logs instead of IPs, improving readability.
• Trustworthiness: IPs with PTR records are considered more trustworthy.
• Anti-spam systems: Tools like SpamAssassin and Postfix perform PTR checks.

FCrDNS (Forward-Confirmed Reverse DNS)

The most reliable configuration is when the PTR record matches the A record:

# 1. PTR record: IP → Domain
203.0.113.50  →  mail.example.com

# 2. A record: Domain → IP (must be the same IP)
mail.example.com  →  203.0.113.50

This bidirectional verification (FCrDNS) significantly improves email deliverability.

Setting Up PTR Record in the REXE Panel

To set up a PTR record in the REXE customer panel:

1. Log in to the customer panel — sign in to your account at panel.rexe.tr.
2. Go to the My Servers section.
3. Select the server for which you want to set up a PTR record.
4. Click the Network Settings or IP Management tab.
5. Find the PTR / Reverse DNS field for the relevant IP address.
6. Enter the PTR value (e.g., mail.example.com).
7. Save.

Requirements for PTR Record

• An A record must be created for the domain you use as the PTR value.
• The PTR value must match the A record pointing to the IP address (FCrDNS).
• The PTR value must be a fully qualified domain name (e.g., mail.example.com, server1.example.com).

Verifying the PTR Record

Testing with dig -x

# Reverse DNS query
dig -x 203.0.113.50

# Short output
dig -x 203.0.113.50 +short

# With a specific DNS server
dig -x 203.0.113.50 @8.8.8.8

# For IPv6
dig -x 2001:db8::1

Example output:

;; ANSWER SECTION:
50.113.0.203.in-addr.arpa. 3600 IN PTR mail.example.com.

Testing with host Command

# Reverse DNS query
host 203.0.113.50

# Example output:
# 50.113.0.203.in-addr.arpa domain name pointer mail.example.com.

Testing with nslookup

nslookup 203.0.113.50

# Example output:
# 50.113.0.203.in-addr.arpa  name = mail.example.com.

FCrDNS Verification

# 1. Check PTR record
PTR=$(dig -x 203.0.113.50 +short)
echo "PTR: $PTR"

# 2. Check A record of PTR
A=$(dig +short $PTR)
echo "A record: $A"

# 3. Do they match?
if [ "$A" = "203.0.113.50" ]; then
  echo "FCrDNS: SUCCESS"
else
  echo "FCrDNS: FAILED"
fi

PTR Configuration for Email Server

PTR Check with Postfix

Postfix can perform PTR checks for incoming connections:

# /etc/postfix/main.cf
smtpd_client_restrictions =
    permit_mynetworks,
    reject_unknown_client_hostname,  # Reject IPs without PTR record
    permit

Using with SPF, DKIM and DMARC

A PTR record alone is not sufficient. For email security:

# SPF record
example.com.  IN  TXT  "v=spf1 ip4:203.0.113.50 ~all"

# DKIM (mail._domainkey)
mail._domainkey.example.com.  IN  TXT  "v=DKIM1; k=rsa; p=..."

# DMARC
_dmarc.example.com.  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

Common Issues and Solutions

Issue 1: No PTR Record

Symptom: Emails are going to spam or being rejected.

# Check
dig -x SERVER_IP +short
# If output is empty, there is no PTR record

Solution: Add a PTR record from the REXE customer panel.

Issue 2: PTR and A Record Don't Match

Symptom: FCrDNS check fails.

# Check PTR record
dig -x 203.0.113.50 +short
# Output: mail.example.com.

# Check A record
dig mail.example.com A +short
# Output: 203.0.113.237  (different IP — problem!)

Solution: Update the A record to the same IP as the PTR.

Issue 3: PTR Propagation Delay

PTR records are subject to propagation time just like regular DNS records. Wait 24-48 hours after making changes.

# Check from different DNS servers
dig -x 203.0.113.50 @8.8.8.8 +short
dig -x 203.0.113.50 @1.1.1.1 +short

Issue 4: Multiple PTR Records

There should not be multiple PTR records for one IP. This can cause email issues.

# List all PTR records
dig -x 203.0.113.50
# There should be only one PTR record in the ANSWER SECTION

Email Blacklist Check

After setting up the PTR record, check if your IP is on any blacklists:

# Check from command line
for bl in zen.spamhaus.org bl.spamcop.net b.barracudacentral.org; do
  result=$(dig +short 50.113.0.203.$bl)
  if [ -n "$result" ]; then
    echo "BLACKLISTED: $bl ($result)"
  else
    echo "Clean: $bl"
  fi
done

Conclusion

A PTR record is a critical DNS component for email deliverability and network security. Easily configured from the REXE panel, a PTR record increases your server's trustworthiness and prevents your emails from ending up in spam. Make sure your PTR and A records match with FCrDNS configuration.