rDNS stands for Reverse Domain Name System. In the (standard) Domain Name System (DNS), domains resolve to a server’s IP address. If you visit the website comcastbusiness.net, you will be forwarded to the IP address 165.160.15.20, which is the IP address of the server hosting the website.
Similarly, all these websites point to the IP address 20.76.201.171
msftcorp.com
msftc.com
msft.pt
msft.info
go.microsoft
When you visit the above websites, you will be forwarded to the IP address 20.76.201.171.
Many websites can point to the same IP address. These websites can be hosted on the server’s IP address, or the IP address can be used in a CDN. For example:
3.33.130.190is an AWS IP and hosts 29 million domains34.98.99.30is a GCP IP and hosts 7 million domains185.230.63.107is a Wix IP and hosts 7 million domains
The hosted domains database aggregates all the domains to IP address resolutions. It considers virtually all the domains out there and determines to which IP address each domain resolves. Then, it lists those IP addresses and domains in an array.
The difference between rDNS and hosted domain data is that rDNS points to the name of the IP address and usually does not indicate a domain itself. The IP address 3.33.130.190 has the rDNS domain of awsglobalaccelerator.com. The rDNS entry ranges from 3.33.204.140 to 3.33.204.152. On the other hand, hosted domains just list domains hosted on specific IP addresses.
Hosted domain data also includes multiple entries of domains into multiple IP addresses if they are included in a CDN. For example: vs global.com resolves to 3.33.152.147, 15.197.142.173 and 204.246.191.62, which are all AWS Cloudfront CDN IP addresses.
The hosted domain database also accounts for domain redirections. For example, robremus.com redirects to a LinkedIn profile. However, in our Hosted Domains data, we mention that the site hosted on 13.107.42.14 indicates that it ultimately redirects or resolves to that IP address, which is the LinkedIn IP address.
Extended explanation from Max Mouchet, Data Engineer, IPinfo
Hosted domains takes an IP address and tells you which domains points to this IP address in the DNS. For example if the DNS contains the following entries:
domain | ip
------------|---------
amazon.com | 1.1.1.1
google.com | 2.2.2.2
google.de | 2.2.2.2
google.fr | 2.2.2.2
Then hosted domains will look like this:
ip | hosted domains
---------|---------------------------------
1.1.1.1 | amazon.com
2.2.2.2 | google.com,google.de,google.fr
Pretty straightforward! The key here is that to build this you need to (1) obtain a list of all domains and (2) resolve the IP address for each of these domains, both of which are relatively non-trivial. There is no built-in mechanism in DNS to do this, so that’s where our value is with this product.
Reverse DNS, on the other hand, is a built-in DNS feature, but it serves a very different purpose than it’s name might let one think.
It allows network operators to give a name to IP addresses. This is usually to make debugging easier. For example Google might want to give a name like server-123.dc1.paris.google.com to the 2.2.2.2 IP address so that it knows that this IP address belong to some server in their Paris datacenter.
This is independent from the domains hosted on this IP address. To combine both examples, we would have something like this:
ip | hosted domains | reverse dns
---------|----------------------------------|---------------------------------
1.1.1.1 | amazon.com | server-123.nyc.amazon.com
2.2.2.2 | google.com,google.de,google.fr | server-123.dc1.paris.google.com
(Those are made-up examples, actual IPs / domains would be different in practice)
As you can see the two are different things and fit different use cases. Generally you can assume that unless a customer is technical and knows what “reverse DNS” is, then they actually want/need “hosted domains”.
Reverse DNS is a very technical data point. The main use case is probably infrastructure discovery/mapping for cybersecurity companies.