Configure DNS Reverse Lookup Zones and PTR Records (Windows Server 2016)

In this tutorial, I’ll show you step by step instructions for configuring reverse DNS lookup zones and PTR Records on Windows Server 2016.

Reverse lookup zones are used to resolve IP addresses to a hostname. For reverse lookup zones to work they use a PTR record that provides the mapping of the IP address in the zone to the hostname.

For example, I can look up the IP and see that it resolves to the hostname “nodaway”.  Without a reverse lookup zone and PTR record, I would not be able to do this.

Do You Really Need Reverse Lookup Zones and PTR Records?

Every network is different so it depends. Unless you host your own email server or have an application that requires it may not be required.

Even if you don’t have requirements for them I still recommend setting them up because they are extremely helpful when troubleshooting. You can read more about this in my DNS Best Practices guide.

How to Configure Reverse Lookup Zones on Windows Server 2016

These steps are very similar across other all server versions server versions (2008, 2012).

Step 1: Open the DNS Management Console

On Windows Server 2016 just type DNS in the search Box to quickly find the DNS console.

Step 2: Create New Reverse Lookup Zone

In the DNS console right click on “Reverse Lookup Zones” and Select “New Zone”

This will start the new zone wizard.

Step 3: Choose Zone Type (New Zone Wizard)

On the Zone Type page select Primary Zone

Choose to replicate to all DNS servers running on domain controllers in this domain.

Choose IPv4 or IPv6, for this demo I’m setting up IPv4.

Now, type in the start of the subnet range of your network.

For this demo I’m setting up a zone for subnet

Choose dynamic update option.

I recommend picking the first option “Allow only secure dynamic updates”

That completes the wizard, click finish

Verify Reverse Lookup Zone

Back in the DNS console click on “Reverse Lookup Zone”

I can now see the new zone listed. The subnet will display backwards that is normal.

Now I’ll click the zone to view the reocrds

So far I have only the SOA and NS resource records, no PTR records.

Once clients start dynamically updating their DNS the PTR records should start populating. You can also manually create PTR records for systems that are not configured to dynamically update.

How to Create PTR Records

Lets walk through manually creating a PTR record. This is only needed if a system is not configured to dynamically update. This may be the case for systems with static IP addresses like servers.

Right click the zone and select “New Pointer (PTR)”

Enter the Host IP Address and Host name fields and click OK.

I’m creating a record for IP, with the hostname of pc1.

Back in the DNS console I can see the PTR record listed.

How to Verify PTR Record Is Working

To verify the PTR record works open up PowerShell (command prompt will work also).

type nslookup followed by the IP you want to lookup.

You can see in the picture above the IP returned the hostname PC1.

That is all there is to it.

Pretty easy right?

Recommended Tool: Permissions Analyzer for Active Directory

This FREE tool lets you get instant visibility into user and group permissions and allows you to quickly check user or group permissions for files, network, and folder shares.

You can analyze user permissions based on an individual user or group membership.

This is a Free tool, download your copy here.

14 thoughts on “Configure DNS Reverse Lookup Zones and PTR Records (Windows Server 2016)”

  1. No corresponding A record?

  2. This article is very helpful and well explained. Thanks a lot!

  3. How can I consolidate many reverse lookup zones into one zone?
    I have the following zone:

    and want to consolidate all the following zone into zone

    best regards

    • Hi Mari, just enter 2 of the octets when creating your Reverse zone. When you enter your octets it tells the system which numbers to take into consideration for grouping. So to your request, enter only 10.196

      • Nelson, I have a question, could you help me with it perhaps? I am trying to set up reverse zones for 2 of our domain controllers. I have to submit a change request and the Authorizer/Approver is asking “Are you creating a reverse arpa zone for 10/8 or 10.100/16 or the two /24s?” I do not understand. I just need the 2 DC’s to point back to a few IP’s. Could you help me answer this question?

  4. Thanks – this was a good tutorial and reminder that cleaned up a few things for me

  5. Thank you for this post.

    • No problem

  6. Nicely explained.

  7. Concept is clear

  8. God Bless you. This is a good tutorial and it help me to solve a very urgent A record issue.

    • Jamiu, thanks for the feedback.

  9. Good tips….. Very clear…. Lo p

  10. I was running into this issue after using DNSSEC to sign reverse zones. It couldn’t create the record. I ended up trying first to unsign the zone but it didn’t resolve the issue. After deleting and recreating the zone, leaving it unsigned, it then started to allow PTR records.


Leave a Comment