Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

While SSHing into my server with an RSA key, I get this message:

Address 1 maps to, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!

Even though I get this error, I am still able to SSH into the machine.

I examined the DNS and figured out the issue. This server has lots of vhosts, so we have multiple A records for the same IP address.

For example:


(there are a few more that point to the same IP)

I am trying to SSH to, and I am getting the above error. How do I get SSH to realize that the IP has multiple domain names that point to it?

NOTE: I can't ssh to because that subdomain is going through CloudFlare's proxy.

UPDATE: I tested this on two computers. One gave me that error, one did not. Why would that be?

1 This is a fake IP, I made up. I'm not sure if it really points anywhere.

share|improve this question

marked as duplicate by voretaq7 May 2 '13 at 16:52

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Have you tried adding the reverse DNS entry for to your hosts file, since DNS looks there first? – NickW May 2 '13 at 15:56
@NickW: Yeah, I guess I could do that. I just hope our IP address never changes :-) – Rocket Hazmat May 2 '13 at 15:58
@NickW: That did get rid of the error :-D I guess that's a good solution :-) – Rocket Hazmat May 2 '13 at 15:59
Let me put that in an answer then :) – NickW May 2 '13 at 16:02
up vote 1 down vote accepted

If you put the reverse DNS name for in your hosts file, that will usually be the first response returned by DNS.

share|improve this answer
Entries in /etc/hosts will not "always" be the first response returned by DNS. Specifically, if dns is before hosts in /etc/nsswitch.conf your resolver should return the DNS result (if one exists) before ever looking at the hosts file. In any case, this is a pretty dirty hack: the Right Thing would be to fix the broken reverse DNS (or disable the DNS check if you really don't care). – voretaq7 May 2 '13 at 16:52
This is a dirty hack, but how would he set up multiple RDNS entries for the same IP to always return the correct answer? I'll change the always though. – NickW May 2 '13 at 16:59
@voretaq7: So, how do I fix the DNS? I have multiple A names for the same IP. – Rocket Hazmat May 2 '13 at 17:05
@RocketHazmat You make the PTR record match the hostname you SSH into, and you always SSH into the machine with that specific hostname. Or you disable the reverse DNS check. – voretaq7 May 2 '13 at 17:24
@voretaq7: The server has UseDNS no. And it doesn't seem like CloudFlare lets me set PTR records. – Rocket Hazmat May 2 '13 at 17:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.