Reverse DNS lookup, also known as rDNS, is a process used to determine the hostname associated with a given IP address. Unlike a forward DNS lookup, which maps a hostname to an IP address, a reverse DNS lookup does the opposite.

Reverse DNS lookups are often used for security purposes, as they can help identify the origin of an incoming network connection or email message. For example, an email server may perform a reverse DNS lookup on the IP address of an incoming message to verify that the hostname of the sender matches the IP address of the sender, as a way of preventing email spoofing.

Reverse DNS lookups are performed using a special type of DNS record called a PTR (Pointer) record, which maps an IP address to a hostname. The PTR record is stored in a reverse DNS zone, which is organized differently from the forward DNS zone used for forward DNS lookups. In a reverse DNS zone, the IP addresses are divided into blocks, with each block corresponding to a different reverse DNS zone.

To perform a reverse DNS lookup, the IP address is first reversed and converted into a hostname in the reverse DNS zone. For example, the IP address "10.0.2.1" would be reversed to "1.2.0.10.in-addr.arpa". This hostname can then be used to look up the associated PTR record and determine the hostname of the associated machine.