Reverse DNS Zone Generator

A reverse DNS lookup turns an IP address back into a hostname. In IPv4, that answer lives under the in-addr.arpa tree, where the address octets are reversed before a PTR record names the host. The direction matters: forward DNS starts with a name and finds an address, while reverse DNS starts with the address that appeared in a log, mail connection, monitoring alert, or abuse report.

PTR records are often treated as housekeeping, but they carry real operational weight. Mail systems use them as one signal when judging a sending address, hosting teams use them to make customer assignments recognizable, and network operators use them to keep incident evidence readable. A PTR record is not proof of identity or ownership, yet a missing or stale one can slow down troubleshooting and make an otherwise legitimate service look unfinished.

Authority is the boundary that causes most reverse DNS surprises. Controlling example.com does not automatically let you publish PTR records for 192.0.2.130. The organization that holds the reverse DNS parent for the address block, usually an ISP, cloud provider, hosting provider, or registry delegation, must serve the zone or delegate the matching child zone to your nameservers.

PTR record

The DNS record that maps a reverse owner name to a hostname.

Reverse origin

The zone name below in-addr.arpa, such as 2.0.192.in-addr.arpa. for 192.0.2.0/24.

SOA record

The authority header that carries the primary nameserver, responsible mailbox, serial, and zone timing values.

Classless delegation

The RFC2317 pattern used when a delegated IPv4 range is smaller than a clean /24 reverse zone.

The useful mental model is to separate the final PTR answer from the path a resolver must follow. The owner label, reverse origin, parent delegation, SOA header, nameserver list, and address coverage all need to describe the same allocation. If those pieces disagree, the PTR row may be syntactically valid but unreachable from public DNS.

How to Use This Tool:

Start with the delegated IPv4 range, then enter the authority and PTR information that should appear in the zone text. The generated output changes as the fields change, so use the checks before copying records into a DNS change.

1. Enter IPv4 subnet as CIDR, such as 192.0.2.128/28 or 10.20.30.0/24. If the address contains host bits, the range is normalized to its network base.
2. Set Forward hostname suffix, Default TTL, Primary nameserver, Responsible mailbox, Zone serial, and Authoritative nameservers. Relative hostnames are expanded under the forward suffix where that is appropriate.
3. Paste PTR entries as address,hostname,ttl,note rows. The address can be a full IPv4 address, a final octet for matching ranges, or a reverse owner label. Leave the hostname blank only when the fallback pattern should fill it.
4. Use Load sample for a working classless example, Normalize to rewrite current names and rows into generated form, and Reset entries when you want to clear the PTR list.
5. Open Advanced for RFC2317 child-label style, parent CNAME coverage, duplicate-address policy, record sorting, SOA timers, fallback hostname pattern, and generated comments.
6. Read Zone Checks before handoff. Needs edits means blocking input problems remain, Review warnings means the zone text needs operator review, and Ready to lint means local checks did not find blocking issues.
7. Copy or download Reverse Zone. When the result uses the RFC2317 child strategy, give the Parent CNAMEs output to the operator of the parent /24 reverse zone as well.

Interpreting Results:

Ready to lint is a local drafting status. It means the entered fields produced internally consistent zone text, not that the parent delegation exists, the zone has loaded on an authoritative server, or the PTR target has matching forward records.

Review warnings points to conditions that often need a DNS operator's judgment. Examples include a single nameserver, a primary nameserver missing from the NS list, a serial that is valid but not date-shaped, SOA timer relationships, duplicate PTR rows, or a non-octet prefix that can only be emitted as a parent-zone fragment.

PTR targets should normally be hostnames that have suitable forward address records. Some mail and hosting checks expect forward-confirmed reverse DNS, where the PTR name resolves back to the same address. The reverse-zone output does not perform that forward lookup.

Technical Details:

IPv4 reverse DNS follows the address hierarchy, not the forward-domain hierarchy. A /24 block such as 192.0.2.0/24 becomes 2.0.192.in-addr.arpa., and the address 192.0.2.130 is represented by owner label 130 inside that zone. The PTR record then points from that owner label to the target hostname.

Octet boundaries are straightforward because DNS labels line up with the dotted IPv4 octets. Prefixes smaller than a /24 cut through the last octet, so RFC2317 creates a child label beneath the parent /24 reverse zone and uses parent CNAME records to steer individual address owners into that child zone.

Rule Core:

The accepted subnet range is /8 through /32. CIDR input is normalized to the base network address before the reverse origin, broadcast address, range size, owner labels, and parent-record strategy are calculated.

Transformation Core:

Classless child labels can be written as 128-28, 128/28, or 128.28. Hyphen labels avoid slash handling surprises in some zone-transfer and file workflows, while slash labels resemble many RFC2317 examples. The parent CNAME target and child reverse origin must use the same label style.

Validation Boundaries:

Accuracy and Privacy Notes:

The generated text is a draft for DNS review. Validate it with the DNS server software that will serve the zone, confirm parent delegation with the address-block holder, and test lookups after deployment. Local checks cannot prove that a registry, ISP, cloud provider, or authoritative server has accepted the records.

• Run a zone checker such as named-checkzone against the copied zone text.
• Install parent NS and CNAME records when RFC2317 output is used.
• Verify matching forward records when policy requires forward-confirmed reverse DNS.
• Increment the SOA serial before each authoritative reload or transfer rollout.

The entered values are processed in the browser. Record generation uses the values you type; it does not perform live DNS lookups, contact authoritative nameservers, or verify records with a registry or provider.

Worked Examples:

Classless hosting block. A delegated range of 192.0.2.128/28 uses an RFC2317 child zone under 2.0.192.in-addr.arpa.. PTR rows for 192.0.2.130, 192.0.2.131, and bare final octet 132 become owner labels in that child zone. The parent zone still needs CNAME stubs for the selected address coverage.

Direct /24 zone. A range of 192.0.2.0/24 uses 2.0.192.in-addr.arpa. directly. PTR owners are final octets such as 130, and the parent-record output explains that RFC2317 records are not required.

Blank hostname row. A row with address 133 and no hostname uses the fallback pattern. With host-{last}.{domain} and forward suffix corp.example, the PTR target becomes host-133.corp.example..

Out-of-range address. A PTR row for 192.0.2.250 inside a 192.0.2.128/28 draft is blocked because the address does not belong to that delegated range, even though the final octet would be valid in a larger parent /24.

FAQ:

Glossary:

in-addr.arpa

The IPv4 reverse DNS namespace where address octets are arranged from least-specific to most-specific DNS label order.

PTR record

A pointer record that maps a reverse owner name to a hostname.

RFC2317

The classless IPv4 reverse delegation pattern that combines a child reverse zone with parent CNAME records.

SOA serial

The numeric version field used by secondary nameservers to detect changed zone data.

SOA minimum

The SOA field commonly used for negative-cache timing under modern DNS behavior.

References:

• RFC 1035: Domain Names - Implementation and Specification, RFC Editor, November 1987.
• RFC 2317: Classless IN-ADDR.ARPA Delegation, IETF, March 1998.
• RFC 2308: Negative Caching of DNS Queries, RFC Editor, March 1998.
• ISC Knowledgebase: Classless in-addr.arpa subnet delegation, Internet Systems Consortium, updated May 25, 2021.
• ARIN: Managing Resource Records, American Registry for Internet Numbers.