7

Consider the following run of the dig command, where I simply query for the IP address of google.com:

$ dig google.com

; <<>> DiG 9.16.1-Ubuntu <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32427
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1


;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com.                    IN      A


;; ANSWER SECTION:
google.com.             276     IN      A       142.250.71.14


;; Query time: 1437 msec
;; SERVER: 192.168.225.1#53(192.168.225.1)
;; WHEN: Sun May 15 23:49:53 IST 2022
;; MSG SIZE  rcvd: 55

The response says that 142.250.71.14 is the IP. Now, if I were to run a reverse DNS lookup with the same IP, such as:

$ dig -x 142.250.71.14

; <<>> DiG 9.16.1-Ubuntu <<>> -x 142.250.71.14
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61497
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0


;; QUESTION SECTION:
;14.71.250.142.in-addr.arpa.    IN      PTR


;; ANSWER SECTION:
14.71.250.142.in-addr.arpa. 67394 IN    PTR     maa03s34-in-f14.1e100.net.


;; Query time: 15 msec
;; SERVER: 192.168.225.1#53(192.168.225.1)
;; WHEN: Sun May 15 23:52:46 IST 2022
;; MSG SIZE  rcvd: 83

The response says that the IP points to maa03s34-in-f14.1e100.net (and not google.com). How can this difference be explained?

edddd
  • 189
  • 4

1 Answers1

12

Forward and reverse DNS have almost nothing in common.

Reverse DNS is treated like forward DNS, except for using a special zone (in-addr.arpa), which can then be delegated and subdelegated. This happens entirely independently of forward DNS.

Again, for the sake of clarity, when a forward DNS entry is made, there no reverse entry can be automatically generated within DNS (it can, of-course, be programmed where the DNS server has access to the appropriate part of the reverse zone, but its not automatic, and indeed not even common).

(Another way to look at why this doesn't matter is that many, many domains use a common IP address, and many domains use more then 1 IP address - so there can be no 1:1 mapping).

davidgo
  • 73,366