# Forward-confirmed reverse DNS

Forward-confirmed reverse DNS looks up an address's PTR name, then resolves that name back; a name that comes back to the same address proves who owns it.

Date: 2026-09-12

Forward-confirmed reverse DNS is a two-step check on an IP address: look up the PTR record that names the address (`crawl-66-249-66-1.googlebot.com`, say), then resolve that name forward to its A or AAAA records and see whether the original address is among them. Anyone who controls a block can publish any PTR name they like, so the reverse lookup alone proves nothing; the forward confirmation is what turns a name into evidence, because only the owner of the name's domain can make it resolve back.

## What Spaw answers

The check runs only when a lookup asks for it with `hostname: true`, because it is a live DNS query with a two-second budget. `hostname` is the PTR name, `hostname_verified` whether it forward-confirmed, and a verified name under an operator's documented domain — googlebot.com, google.com, search.msn.com, applebot.apple.com, yandex.*, crawl.baidu.* — proves the crawler and sets `is_crawler` even where no published range does. `hostname_kind` reads the naming convention (`dynamic` for pool and DHCP names, `static` for fixed and hosting names) and `hostname_domain` is the registrable domain, so the operator behind a name is one field.

## What it does not mean

An unverified name is just text the block's owner chose; it is never used to prove anything. And a verified name proves the operator, not the intent: a real Googlebot address is Google's, whatever it happens to be fetching.

Reference: https://spaw.co/glossary/forward-confirmed-reverse-dns