Why Reverse DNS and FCrDNS Matter for Security and Mail Deliverability
Standard forward DNS resolves domain names to numerical IP addresses. Reverse DNS (rDNS) performs the inverse: resolving an IP address back to its canonical domain pointer (PTR record).
While forward DNS is managed in the domain registrar's zone file, reverse DNS is delegated hierarchically through the Regional Internet Registries (ARIN, RIPE, APNIC, etc.) down to the owner of the IP subnet or Autonomous System.
Forward-Confirmed Reverse DNS (FCrDNS)
Anyone can configure a fake forward record or point a domain name at any IP. However, because only the legitimate IP block holder controls the reverse DNS PTR zone, receiving servers use FCrDNS to establish cryptographic and administrative authenticity:
- The receiving mail server inspects the connecting client's IP (e.g.
198.51.100.10). - It queries
10.100.51.198.in-addr.arpafor PTR → returnsmail.example.com. - It queries forward DNS for
mail.example.comA record → verifies it matches198.51.100.10.
If step 3 fails, the connection is classified as an unverified dynamic residential line or spoofed origin, and emails are dropped into the spam folder or rejected with an SMTP 550 error.