# Reverse DNS Lookup Sweeps

> Perform reverse DNS lookup sweeps to map IP ranges to hostnames, uncover hidden infrastructure, and identify targets during network enumeration.

- **URL:** https://hackindex.io/services/dns/enumeration/reverse-dns-lookup-sweeps
- **Path:** DNS > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/dns/enumeration.md)
- **Published:** 2026-01-03
- **Updated:** 2026-05-06

PTR records expose internal hostnames. Sweep ranges to map live hosts and naming conventions.

- **Single reverse lookups** use dig, nslookup, or host to resolve individual IPs to hostnames.
- **Range sweeps with dig** loop through a /24 and collect every PTR response for live host mapping.
- **dnsrecon reverse mode** automated reverse sweep against a CIDR range with optional target resolver.
- **fierce range mode** maps reverse lookups back to the target domain context for adjacent host discovery.

## Single Reverse Lookup

```bash
dig -x $TARGET_IP
nslookup $TARGET_IP
host $TARGET_IP
```

All return PTR if present.

## Range Sweep with dig

```bash
# Set BASE to the first three octets of your target subnet (e.g. BASE="10.10.10")
BASE="$TARGET_SUBNET_BASE"
for i in {1..254}; do dig -x ${BASE}.$i +short; done
```

Non-empty output indicates live/named hosts.

## Automated Reverse Sweeps

### Dnsrecon

```bash
dnsrecon -r $TARGET_SUBNET/24
dnsrecon -r $TARGET_SUBNET -n $TARGET_IP
```

### Fierce range mode

```bash
fierce --range $TARGET_SUBNET_BASE.1-$TARGET_SUBNET_BASE.254 --domain $DOMAIN
```

Maps reverses to domain context.