What is FCrDNS?

FCrDNS (forward-confirmed reverse DNS) is a check that an IP address's reverse DNS name points back to that same address, so the name can be given some trust.

A reverse lookup turns an address into a name using a PTR record, but that record is just a claim made by whoever controls the reverse zone for the address. Nothing stops them publishing a PTR that says their address is mail.bank.example. FCrDNS closes that gap with a second, forward lookup:

1. Look up the PTR record for the connecting address, say 192.0.2.25, and get a name such as mail.example.net.
2. Look up the A (or AAAA) records for mail.example.net.
3. If 192.0.2.25 is among the results, the name is forward-confirmed. If not, treat the name as unverified.

The check works because faking it requires control of both the reverse zone (held by whoever was allocated the address) and the forward zone (held by the owner of the domain). It proves that the two agree, not that the host is honest or well run.

The place most engineers meet FCrDNS is email: many receiving mail servers reject or penalise connections from addresses without a forward-confirmed name, so a new mail server on a fresh address needs its provider to set a matching PTR record. Some logging and access-control systems also only record or trust names that confirm. The same caution applies when reading traceroute output: a hop's name comes from a PTR record and might be stale or misleading, which is one reason to run it with -n while troubleshooting. See also DNS. The Linux Network Connectivity lesson walks through reverse DNS and forward confirmation with real lookups.