Reverse DNS Database

The Reverse DNS Database contains the PTR record (reverse DNS hostname) of every IPv4 address on the Internet. It is the result of a complete sweep of the routable IPv4 address space: 3,702,258,432 IP addresses queried, yielding 1,039,377,899 resolved PTR records. The database is re-crawled from scratch and re-published every month.

Reverse DNS hostnames are one of the most information-dense signals that exist for an IP address. A single PTR record such as ec2-3-137-190-186.us-east-2.compute.amazonaws.com reveals the hosting provider, the service type and the region of an IP address — while dynamic-077-183-045-122.77.183.pool.telefonica.de immediately identifies a residential dial-up customer. This database gives you that signal for the entire Internet, in a single self-contained download.

# Purchase Database

To purchase the database, you need to create a free account. Database subscriptions are billed monthly and can be canceled at any time. Learn more about the pricing and the terms. If you purchase the database, you will receive a download link to the database file for all formats.

# Database Coverage

Unlike most reverse DNS datasets, this database does not only store the IP addresses that have a PTR record — it stores the DNS outcome for every single queried IPv4 address. For each IP, the database records one of the following statuses:

• has_ptr - The IP has one or more PTR records. All hostnames are included in the database.
• noerror_empty - The authoritative nameserver answered, but returned no PTR record.
• nxdomain - The reverse zone explicitly states that no PTR record exists for this IP.
• servfail - The responsible nameserver failed to answer the query correctly.
• refused - The responsible nameserver refused the query.
• timeout - No response was received for the query (the reverse zone is often not delegated at all).
• net_error - A network error occurred while querying.
• lame_delegation - The reverse zone is delegated to a nameserver that does not answer authoritatively.

The negative statuses are just as valuable as the positive ones: nxdomain vs. timeout distinguishes a network operator that actively manages its reverse zones from address space with no DNS infrastructure at all — a strong signal for network hygiene scoring and abuse analysis.

Where a PTR hostname could be verified with a forward lookup, the database additionally stores the Forward-Confirmed reverse DNS (FCrDNS) result — whether the returned hostname resolves back to the original IP address.

# Database Format (.rdnsz)

Storing a billion hostnames as plain text produces files of 30+ GB. This database instead ships in .rdnsz, a purpose-built binary format that stores the complete sweep — all 3,702,258,432 query results including all hostnames — in roughly 0.99 GB. That's less than a byte per queried IP address.

The format achieves this with three techniques:

• IP delta encoding - records are sorted by IP address and only the varint-encoded difference to the previous IP is stored.
• Hostname templating - the IP address embedded in hostnames like 40.64.0.1.megaegg.ne.jp is replaced by a placeholder token, so the millions of structurally-identical ISP hostnames compress down to almost nothing.
• Zstandard block compression - records are grouped into blocks of 65,536 and compressed with zstd. Each block is independently decompressible, so the database can be streamed without loading it into memory.

The database is delivered as a .tar.gz package containing 20 .rdnsz shard files (partitioned by IP range), the zero-dependency reader tool rdnsz_query.js, a machine-readable stats.json and the complete format documentation. The binary format specification is included, so you can implement a reader in any language — the reference implementations in JavaScript and Go are less than 300 lines each.

A converted excerpt of the database looks like this (IP address, tab, PTR hostnames):

1.0.16.108	st2-smtp.kakeibo.tepco.co.jp
1.0.64.20	20.64.0.1.megaegg.ne.jp
1.0.64.40	40.64.0.1.megaegg.ne.jp
1.0.64.60	60.64.0.1.megaegg.ne.jp
1.0.64.80	80.64.0.1.megaegg.ne.jp
1.0.64.100	100.64.0.1.megaegg.ne.jp
1.0.64.120	120.64.0.1.megaegg.ne.jp
1.0.64.140	140.64.0.1.megaegg.ne.jp
1.0.64.160	160.64.0.1.megaegg.ne.jp
1.0.64.180	180.64.0.1.megaegg.ne.jp
1.0.64.200	200.64.0.1.megaegg.ne.jp
1.0.64.220	220.64.0.1.megaegg.ne.jp
1.0.64.240	240.64.0.1.megaegg.ne.jp
1.0.65.4	4.65.0.1.megaegg.ne.jp

# How to use the Reverse DNS Database?

Every database package includes rdnsz_query.js, a self-contained reader tool with zero npm dependencies — it only requires Node.js ≥ 22.15 (zstd support is built into Node itself). To try it out, download the sample database and the tool:

curl -O https://ipapi.is/data/samples/Reverse-DNS-Database-Sample.rdnsz
curl -O https://ipapi.is/src/rdnsz_query.js

Show the crawl statistics of a database file:

node rdnsz_query.js stats Reverse-DNS-Database-Sample.rdnsz

which outputs:

Reverse-DNS-Database-Sample.rdnsz: shard 0/1 | crawled 2026-07-02 | total=100,000 | has_ptr=9,480 noerror_empty=6 nxdomain=87,189 servfail=457 timeout=2,868
---
files: 1
queried IPs: 100,000
  has_ptr                   9,480  (9.5%)
  noerror_empty                 6  (0.0%)
  nxdomain                 87,189  (87.2%)
  servfail                    457  (0.5%)
  timeout                   2,868  (2.9%)
crawl date: 2026-07-02

Convert the database to plain text (TSV) or JSONL:

node rdnsz_query.js dump Reverse-DNS-Database-Sample.rdnsz --limit 5

which outputs:

1.0.16.108	st2-smtp.kakeibo.tepco.co.jp
1.0.64.20	20.64.0.1.megaegg.ne.jp
1.0.64.40	40.64.0.1.megaegg.ne.jp
1.0.64.60	60.64.0.1.megaegg.ne.jp
1.0.64.80	80.64.0.1.megaegg.ne.jp

Look up a single IP address:

node rdnsz_query.js lookup 1.0.64.20 Reverse-DNS-Database-Sample.rdnsz

which outputs:

{
  "ip": "1.0.64.20",
  "status": "has_ptr",
  "ptr": [
    "20.64.0.1.megaegg.ne.jp"
  ],
  "fcrdns_match": true
}

After purchasing the database, you will find your personal download command in the dashboard. The full database is downloaded the same way:

wget -O reverseDNSDatabase.tar.gz \
  'https://ipapi.is/app/getData?type=reverseDNS&format=rdnsz&apiKey=YOUR_API_KEY'

# What is Reverse DNS?

Normal (forward) DNS resolves a hostname such as ipapi.is to an IP address. Reverse DNS goes the other way: it resolves an IP address to a hostname by querying the PTR record of the IP in the special in-addr.arpa zone. The PTR record for the IP 1.2.3.4 is stored at 4.3.2.1.in-addr.arpa.

The network operator that owns an IP range controls its reverse zone. That is exactly what makes reverse DNS so valuable: the hostname is set by the party that actually operates the IP address, and operators encode rich structural information into their naming schemes — provider names, service types (mail, vpn, nat, dhcp, static), locations, customer assignments and much more.

# How is the Database collected?

The database is produced by our own distributed reverse DNS crawler, which performs a complete sweep of the routable IPv4 address space every month:

• Full coverage: Every routable IPv4 address is queried — not a sample, not only "interesting" ranges. Non-routable, private and bogon space is excluded.
• Distributed crawling: The sweep runs on a fleet of servers, each responsible for a deterministic shard of the address space, with strict per-resolver rate limits to stay a polite DNS citizen.
• Resolver rotation and retries: Queries are spread over many recursive resolvers; failed queries are retried before a negative status is recorded.
• Verification: For resolved hostnames, a forward lookup checks whether the hostname resolves back to the original IP (FCrDNS).

Because each monthly release is a complete, self-contained snapshot, you can also diff two releases to detect infrastructure changes: new hosting ranges being deployed, ISPs renumbering their networks, or address space changing hands.

# Use Cases

• IP classification & enrichment: Classify IP addresses as datacenter, residential, mobile, NAT/CGN or corporate infrastructure based on their PTR naming patterns — the same technique that powers parts of the ipapi.is API.
• Threat intelligence & abuse analysis: Attribute scanning and abusive traffic to actual infrastructure. PTR records expose hosting providers and their customers long before WHOIS records are updated.
• Email deliverability & anti-spam: A missing or generic PTR record is a classic spam signal. Validate sender infrastructure at scale without performing live DNS lookups.
• Asset discovery & attack surface management: Find all hosts of an organization by searching a billion hostnames for its domains — including forgotten infrastructure on IP ranges you did not know about.
• Internet research: Study ISP naming schemes, CGN deployment, IPv4 utilization and infrastructure trends with a complete, consistent snapshot of the IPv4 reverse zone.
• Offline & air-gapped lookups: The entire dataset is a ~1 GB local file. Perform unlimited reverse DNS lookups with zero latency and zero external DNS traffic.

Questions about the database? Contact us — we are happy to help with integration or provide custom exports.