How Reverse DNS (PTR) Records Reveal City Codes and POPs
An engineering breakdown of telecom naming conventions, IATA airport code regex scraping, and how reverse DNS records transform into high-confidence geolocation coordinates.
Quick Answer
Reverse DNS (PTR) records reveal physical location because internet service providers embed standardized geographic abbreviations—predominantly IATA airport codes (e.g., LHR, FRA, NRT) and Telcordia CLLI identifiers—into router and gateway hostnames. Automated GeoIP scrapers parse these strings using regular expression dictionaries to resolve subnets to specific metropolitan exchanges.
- IATA Airport Regex: Carrier router hostnames frequently contain 3-letter airport codes representing the local Point-of-Presence (POP).
- CLLI Telco Standards: North American carriers utilize 8-to-11-character CLLI codes mapping to physical telephone exchange central offices.
- Latency Verification: Modern database algorithms cross-validate PTR geographic hints against round-trip ping times to eliminate spoofing.
1. The Telecom Naming Tradition: Embedding Geography in Hostnames
Under RFC 1035 and RFC 2317, reverse DNS maps an IP address back to a canonical domain name via pointer (PTR) records hosted in the in-addr.arpa (IPv4) or ip6.arpa (IPv6) zones.
Because human network operators manage tens of thousands of router interfaces across global backbones, carriers established standardized naming schemas to facilitate rapid operational triage during outages. Consider an interface hostname on Lumen (formerly CenturyLink):
GeoIP vendors deploy regular expression pipelines against PTR lookups. A typical extraction rule matching common transit providers operates as follows:
Regex: /[-._]([a-z]{3})[0-9]{0,2}[-._](?:cr|bng|gw|edge|core)/iWhen applied to bng02-fra03.de.carrier.net, the capture group extracts fra, querying an internal airport dictionary that maps FRA to Frankfurt am Main, Germany (50.1109° N, 8.6821° E) with high confidence.
2. Production Case Study: The Bogus "Tokyo" Reverse DNS Prank
In 2022, an enterprise cloud hosting customer configured custom reverse DNS PTR records on their California datacenter /24 subnet to read: gw01.tokyo.jp.example-corp.com.
Naive geolocation crawlers that relied solely on regex scraping immediately reclassified the California server block as Tokyo, Japan. However, when anti-fraud engines (such as MaxMind minFraud and Akamai Kona) evaluated the incoming sessions, they detected a glaring contradiction:
Because speed-of-light in fiber dictates a minimum 90ms round-trip time across the Pacific Ocean, the 1.2ms latency unmasked the PTR spoofing instantly. Today, modern GeoIP systems discard PTR clues unless confirmed by latency multilateration.
3. Protocol Frame Dissection: DNS PTR Query Wire Format
Below is a Wireshark packet capture showing an authentic reverse DNS query resolving an IPv4 address to its carrier gateway hostname:
Domain Name System (response)
Transaction ID: 0x9e31
Queries: 1
Name: 105.112.73.180.in-addr.arpa
Type: PTR (Domain name pointer) (12)
Answers: 1
105.112.73.180.in-addr.arpa: type PTR, class IN, ttl 86400,
PTR: bng01-jhb.tm.net.my
Analysis:
"jhb" = Senai International Airport / Johor Bahru, Malaysia
"bng01" = Broadband Network Gateway 01
"tm.net.my" = Telekom Malaysia (AS4788)The string bng01-jhb.tm.net.my contains the crucial geographic marker jhb (Johor Bahru), enabling automated GeoIP indexers to anchor the subscriber directly to southern Malaysia rather than defaulting to the national capital.
4. Engineering Decision Tree: Verifying Reverse DNS Clues
Follow this diagnostic logic to evaluate whether a PTR record reliably indicates true physical geography:
Troubleshooting Decision Tree
[ Reverse DNS (PTR) Evaluation Pipeline ]
|
+------------------------+------------------------+
| |
[ Standardized Airport Code ] [ CLLI Code Detected ]
Matches IATA 3-letter regex: Matches 11-char telco string:
"*.lhr.router.net" (London) "*.chcgilcl*.net" (Chicago)
| |
+------------------------+------------------------+
|
v
[ Latency & BGP Corroboration ]
Does ping time match claimed city?
Does AS-PATH route to regional IXP?
|
+------------------------+------------------------+
| |
[ Match Confirmed ] [ Conflict / Spoofed ]
High Confidence City Tag Flagged as Inconsistent
Accuracy Radius: 5km - 15km Requires verified leased line
(See /proxy-plans/ for verified routes) (Centroid fallback applied)
5. Common Geographic Carrier Naming Conventions Compared
Review the industry naming patterns utilized by Tier-1 carriers across global internet infrastructure:
| Carrier / Network | Sample PTR Syntax | Geographic Code Format | Scraping Reliability | Example Location Decoded |
|---|---|---|---|---|
| Lumen / Level 3 | ae1.cr01.lhr01.lumen.net | IATA Airport Code (lhr) | 98.5% | London Heathrow, UK |
| Arelion (Telia) | s-b5-link.se.arelion.net | Country + City Abbr (se = Sweden) | 94.2% | Stockholm, Sweden |
| AT&T North America | cpe-074-124-001.clt.nc.att.net | Airport + State (clt = Charlotte) | 97.8% | Charlotte, North Carolina |
| Verizon Business | so-0-0-0.chcgilcl.verizon.com | Telcordia CLLI Code (chcgil) | 99.1% | Chicago, Illinois Central Office |
| Enterprise Leased Line | pop01-sin.iepl.enterprise.net | Custom Standard IATA (sin = Singapore) | 99.9% | Singapore Tier-3 Datacenter |
6. Perfecting Reverse DNS with Dedicated Enterprise Leased Lines
Consumer broadband and low-cost shared VPNs feature generic, pooled PTR records (e.g. dynamic-dialup.pool.com) that immediately trigger fraud alerts and bot flags on banking APIs and e-commerce portals.
Enterprise Dedicated Leased Lines (IEPL and IPLC) include fully delegated reverse DNS authority:
- Custom Carrier-Grade PTR Records: Registered with legitimate corporate enterprise domains matching your formal business identity.
- Deterministic Geofeed Synchronization: Aligned with RFC 8805 published feeds, ensuring 100% agreement between PTR, WHOIS, and BGP routing.
- Pristine Business IP Reputation: Completely bypasses consumer broadband CAPTCHAs and datacenter hosting blacklists.
Explore verified enterprise proxy plans with custom PTR delegation support:
Compare Verified Enterprise Leased Lines7. Production Diagnostics: Extracting and Parsing PTR Records via CLI
Extract the reverse DNS pointer record of any target IP and audit its geographic syntax using terminal commands:
Frequently Asked Questions
How do GeoIP databases use Reverse DNS (PTR) records to discover location?
Network engineers encode standardized geographic metadata inside Reverse DNS (PTR) hostnames when provisioning routers, Broadband Network Gateways (BNGs), and customer interfaces. These strings contain IATA 3-letter airport codes (e.g. "lhr" for London Heathrow, "nrt" for Tokyo Narita, "sjc" for San Jose) or CLLI (Common Language Location Identifier) codes. Automated GeoIP scrapers use regular expression parsers to extract these city codes directly from PTR strings.
What is a CLLI code in telecom reverse DNS?
Common Language Location Identifier (CLLI) is an 11-character standardized code developed by Bellcore/Telcordia used by North American and global carriers to identify physical central offices and equipment racks. For example, "CHCGILCL" decodes to Chicago, Illinois, Central Office. When a router hostname contains "chcgil", scrapers immediately map that subnet to Chicago.
Can I change my reverse DNS record to trick websites into thinking I am in another country?
Only if you own the authoritative reverse DNS zone delegated by your RIR (typically requiring a dedicated /24 or enterprise leased line allocation). Consumer broadband users cannot modify their ISP-managed PTR records. Furthermore, modern fraud detection platforms cross-reference PTR clues with BGP routing paths and ping latency; a PTR claiming Tokyo while exhibiting 150ms round-trip latency to Tokyo is immediately flagged as spoofed.
How do enterprise leased lines configure reverse DNS for optimal compliance?
Enterprise IEPL and IPLC line providers configure custom PTR records conforming to formal carrier standards (e.g. "hk-core01.enterprise-transit.net") and register corresponding RFC 8805 geofeeds. This ensures that fraud engines, payment processors, and CDNs recognize the exact metropolitan point-of-presence without triggering proxy detection heuristics.
Data & Technical Sources
- IETF RFC 1035 — Domain Names - Implementation and Specification (PTR Records)
- IETF RFC 2317 — Classless IN-ADDR.ARPA Delegation
- IATA Airline and Airport Code Directory — Official 3-letter airport location identifiers