Configure IPv6 reverse DNS correctly

Understand the forward and reverse paths

Forward DNS starts with a name and returns an address: an AAAA record can map host.example.net to an IPv6 address. Reverse DNS starts with the full address, reverses each hexadecimal nibble, and queries under ip6.arpa for a PTR. Tools perform that expansion for you; hand-writing the long reverse name is error-prone.

PTR records do not prove ownership, authorize mail, or encrypt a connection. They provide a conventional name for an address. Many operators prefer forward-confirmed reverse DNS, where the PTR hostname resolves forward to the original address, but that consistency is a policy signal rather than authentication.

• Choose a stable fully qualified hostname, not a URL.
• Create the AAAA record in the authoritative forward zone.
• Set the matching PTR through whoever controls the reverse zone.

Configure without creating a dependency loop

First create an AAAA record such as host.example.net pointing to the exact IPv6 address assigned to the VPS. Confirm that the address is routed and configured on the guest. Then open the reverse-DNS control for that address and set its PTR value to host.example.net. if the interface accepts an absolute name; follow the panel's formatting guidance on the trailing dot.

If no reverse control exists, ask support whether the prefix is delegated or whether they will create the PTR. Do not assume that control of example.net gives control of ip6.arpa. If VPSEverywhere.com does not expose the necessary capability for the selected address, treat reverse DNS as unavailable until confirmed.

• Use one canonical operational hostname for the PTR.
• Avoid setting a PTR to a name that has no matching AAAA record.
• Record who owns updates when addresses are replaced.

Verify both directions

Query the reverse record with dig -x 2001:db8::1234 +short, replacing the documentation address with your real assigned address. Then query the forward mapping with dig AAAA host.example.net +short. The expected result is that the reverse lookup returns the chosen hostname and the forward lookup includes the original IPv6 address.

Also query an independent recursive resolver to detect delegation or cache differences. DNS changes are not always visible immediately because resolvers may cache old data until its TTL expires. Check authoritative answers before repeatedly editing a correct record.

• Never configure the example prefix 2001:db8::/32 in production.
• Check spelling, final dots, and the exact full IPv6 address.
• Retest after address reassignment or server rebuilds.

For mail, PTR is only one requirement

Mail receivers often inspect reverse DNS, but a matching PTR alone does not establish trustworthy delivery. Configure the mail server's announced hostname consistently, and implement SPF, DKIM, DMARC, TLS, abuse handling, queue monitoring, and appropriate sending practices. Confirm that outbound mail is permitted by the service terms and network policy before deployment.

New address reputation, compromised accounts, or unsolicited traffic can prevent delivery even with perfect DNS. Use a specialist mail service when your team cannot operate the full security and reputation lifecycle.