CODEWITHSUNDEEP
reverse-dns
Lelouch Lamperouge
Lelouch Lamperouge

Reputation: 8411

domain and rDNS data not matching

When I search something on google.com, I see interaction with the following IP address: 172.217.7.132 network snapshot of google query

But when I attempt to reverse lookup the ip address, I get iad30s08-in-f132.1e100.net. and iad30s08-in-f4.1e100.net., not google.com.

What do I need to do in order to correctly identify that this IP address is resolved by google.com.

EDIT

Clarifying the question: My problem is not specific to google.com. I want to programmatically/logically arrive at google.com because that's what my browser requested for.

Same problem exists in the case of amazon: The IP address it resolves to, on reverseDNS gives me: server-13-32-167-140.sea19.r.cloudfront.net. instead of amazon.com

Code for performing reverse lookup: In [1]: def reverse_lookup(ip_address): ...: from dns import reversename, resolver ...: domain_address = reversename.from_address(ip_address) ...: return [answer.to_text() for answer in resolver.query(domain_address, "PTR")]

Upvotes: -1

Views: 951

Answers (2)

guzzijason
guzzijason

Reputation: 154

As others have mentioned, 1e100.net does, in fact, belong to google. Their reverse DNS is going to resolve to whatever they want it to resolve to, and there's not much you can do about that.

Depending on your requirements, another alternative may be using a geolocation database to gather more information about an IP. You can find a demo of this here:

https://www.maxmind.com/en/geoip-demo (enter your example address 172.217.7.132 in the form)

MaxMind has various products (some free, some commercial), so one of them may fit your needs of being able to look up this info programatically.

A different possible solution would be to get access to a WHOIS API, such as:

https://hexillion.com/whois

Example results:

https://hexillion.com/samples/WhoisXML/?query=172.217.7.132&_accept=application%2Fvnd.hexillion.whois-v2%2Bjson

Upvotes: 2

ceejayoz
ceejayoz

Reputation: 180023

https://support.google.com/faqs/answer/174717

1e100.net is a Google-owned domain name used to identify the servers in our network.

Following standard industry practice, we make sure each IP address has a corresponding hostname. In October 2009, we started using a single domain name to identify our servers across all Google products, rather than use different product domains such as youtube.com, blogger.com, and google.com.

Typically, you will get a 1e100.net result when you do a reverse lookup on one of their IPs. Consider it as good as a google.com result would be - you've verified that the IP is controlled by Google if you see it.

One exception to this is the Googlebot crawler, which may return google.com or googlebot.com results. (I would expect this to eventually get moved over to 1e100.net in the future.)

Upvotes: 0

Related Questions