1

I'm seeing this unusual behavior with reverse DNS lookups on this public IP Address: 222.253.228.79. Can someone explain what's going on?


MXToolbox PTR lookup resolved localhost as the domain


ping -a is even stranger; it resolved it to my local PC name (clifford):

ping -a 222.253.228.79
Pinging clifford [222.253.228.79] with 32 bytes of data:

nslookup via Google's public 8.8.8.8 DNS server also resolves it to localhost:

nslookup 222.253.228.79 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Name:    localhost
Address:  222.253.228.79
1

Quite simply, that appears to be what the PTR record is configured to point to. Took a look at mxtoolbox as well and it concurs that it is indeed the returned record.

My guess is it is a default setting for the IP's in that range as .78, and .77 also return localhost. Unless you are specifically trying to do reverse lookups on the IP for some need (In which you should contact them and ask them to update their PTR record) then you can chalk it up to an improper configuration.

1

The localhost PTR record is a technique to bypass source address checks.

It seems that it was mostly misused to trick mail servers to act as an open-relay. Buggy or incorrectly configured mail server would check the PTR record of the source IP address of incoming SMTP connection. When it is localhost it would allow relaying to any destination.

See for example

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.