I want to disable reverse DNS in Apache 2. I have done the following steps:

In apache2/apache2.conf file HostnameLookups is set as OFF

Tcpdump session confirmed thatApache was doing double reverse lookups even though the HostnameLookupsdirective was clearly turned off.

No hostnames insites-available. The problem still remains.

UPD: version of apache is

dpkg -l | grep apache2

ii apache2-mpm-prefork 2.2.16-6+squeeze4 Apache HTTP Server - traditional non-threaded model

ii apache2-utils 2.2.16-6+squeeze4 utility programs for webservers

ii apache2.2-bin 2.2.16-6+squeeze4 Apache HTTP Server common binary files

ii apache2.2-common 2.2.16-6+squeeze4 Apache HTTP Server common files

apache2 -l

Compiled in modules:







I think mod_security is not present.

  • are any apache modules enabled that may cause this behaviour? Especially things like mod_security?
    – Martin
    Oct 30, 2012 at 11:39
  • @Martin Mod_security module is not present, any other solution? Nov 2, 2012 at 23:32
  • I would start by eliminating possibilities. Use a2dismod to disable as many modules as possibles. You can re-enable them with a2enmod. Make sure its not related to some dynamic content served etc.
    – Martin
    Nov 3, 2012 at 17:05
  • 1
    @Martin Regardless of the setting, when mod_authz_host is used for controlling access by hostname, a double reverse lookup will be performed. I have disabled mod-authz_host still the same problem. Also I have compiled with -DMINIMAL_DNS option. Still the same. Any suggestions? Thanks in advance. Nov 6, 2012 at 16:13
  • Can you please share your configuration? I tried to resolve similar situation. In my configuration I have "deny from none". In google is many topic that it is a reason for hostname lookups.
    – Jiri Novak
    Aug 8, 2013 at 19:29

2 Answers 2


Apache does not perform double nameserver lookups (i.e. client IP -> PTR -> A record must match client IP). This kind of functionality is used by mail servers only.

Regardless, if HostNameLookups is Off, and there are no hostnames used inside any vhost definitions or access rules, some 3rd-party module is doing this.

mod_security is a likely candidate, as Martin said before.


I don't have enough reputation here to comment (this isn't a complete answer), but adaptr's intution was correct. The more likely culprit, however, according to the documentation, is mod_access or mod_authz_host, either or both of which do double-lookups for security regardless of the HostnameLookups setting.

The 2.0 documentation says mod_access, and the 2.2 documentation says mod_authz_host, and I'm not conversant with the differences between the two. Selectively disable one, the other, or both in the modules section of your main Apache config and see what results you get.

From the core documentation

Regardless of the setting, when mod_authz_host (says mod_access here if you're reading the 2.0 documentation) is used for controlling access by hostname, a double reverse lookup will be performed. This is necessary for security.

Yes, I know this is a two-and-a-half-year-old question, and not a great one at that. But I found it with a web search, so it's still got google juice.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.