3

I keep noticing that web pages I have open are exchanging messages with third party servers without my permission. This is somewhat annoying, and I would like to find out which pages they are so I can close them. I copied an IP address - 72.21.91.121 - from the TCPdump output, and Googled "reverse dns lookup 72.21.91.121" to see if I could find a hostname that would give me a clue as to the URL of the page and indicate which tab I should close (I tend to have like 20 to 50 tabs open at a time because I can't close anything). I got the website lookip.net, which told me that there was no reverse DNS lookup found.

So I would like to know what is the reason for this. Is this a bad lookup service? Would I have better luck using a different one? Or does this host just not have a hostname associated with it (that doesn't make sense; I thought all hosts had hostnames associated with them).

I know that if this is a third party server, the hostname wouldn't be the same as the site that's sending the packets, but it would at least be a good starting point. I'm not very good at this, but it's something I could get better at as I learn more about how this stuff works. Right now I'm just a novice at this networking stuff. All I have to work with is a basic understanding of networking principles and TCP/IP. I would like to learn more. A lot more.

8

Short answer: There is not requirement that IP addresses provide a reverse lookup, so there are many IP addresses that do not have any reverse DNS lookup zone associated with them.

Long answer: DNS was really designed to do look ups from a human readable name to an IP address. When you do normal DNS query, say for www.example.com", the DNS query is actually a series of queries from least specific to most specific asking "what is the IP address of host www in domain example.com?" It may look a bit like this (simplistic):

  • The root servers are asked for information about com
  • The "com" servers are asked for information about example
  • The "example" servers are asked for information about www
  • You get a response of 192.0.2.4

However, this won't work well when you do a DNS query for an IP address, such as 192.0.2.4 mainly because unlike a host/domain/URL, the most specific information point is at the end. So DNS changes things a bit and asks "what is the server and domain of host 4 in 2.0.192.IN-ADDR-ARPA?" which may look more like this (simplistic):

  • The IN-ADDR-ARPA servers are asked for information about 192.0.2
  • The 192.0.2 servers are asked for information about 4
  • You get a response of www.example.com

Take note, that while one server may contain the information for both the example.com zone and the 2.0.192.IN-ADDR-ARPA zones, they could also be two different servers.

Further, it is often the case that the servers are run by two different companies. For instance, if you pay CompanyX to host your website on their server, you may control the DNS zone for your domain pointing to the IP address of CompanyX's serve (which may be hosting many different domains from different clients) but CompanyX controls the zone for the reverse lookup of the IP address. Their reverse lookup for that IP address would likely reflect a server/domain of CompanyX's.

Even when an entity is entitled to control both the forward and reverse zones, they are not required to provide DNS services for either. You are perfectly within your rights to register a domain name and not provide any DNS service for it.

The end result is that this means that even if you do get a response to a reverse lookup, it may have no relation to the domain name of the service you are accessing. You may be accessing www.example.com but the reverse lookup of that IP address may give you server37.companyx.example or something else entirely.

0
1

Not all hosts have DNS names in a public DNS server. DNS name are just to make it easier for humans, and they are not really required for networking. If this is happening when you open web pages, it is likely that these are ad servers or something similar.

-4

Some Domain names pay extra for privacy and Security.

3
  • That's relevant for information about the registrant, not for DNS labels.
    – Teun Vink
    Dec 25 '15 at 9:08
  • I don't think some dark sites online will like you reversing there dns addresses
    – Spazwik
    Dec 25 '15 at 11:57
  • Such a statement without explanation and supporting documentation is better off as a comment rather than an answer. As a comment it may have garnered some positive reaction, but as an answer it seems to have provoked a negative reaction.
    – Ron Maupin
    Dec 25 '15 at 15:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.