Infrastructure

FCrDNSForward-confirmed Reverse DNS

Definition

Forward-confirmed reverse DNS (FCrDNS) is a two-way check on a sending IP. First the IP’s PTR record must resolve to a hostname; then that hostname’s A or AAAA record must resolve back to the same IP. Only when both directions agree does the IP pass. It is the matched-pair version of reverse DNS, and since February 2024 Gmail and Yahoo require it on every sending IP.

  • Checks a sending IP in both directions, not just one
  • Step one: the IP’s PTR resolves to a hostname
  • Step two: that hostname resolves forward back to the same IP
  • Required by Gmail and Yahoo for senders since February 2024
At a glance
Stands for Forward-confirmed Reverse DNS
Also called Full-circle DNS, iprev
Forward step A / AAAA resolves to the IP
Reverse step PTR resolves to the hostname
Passes when Both directions match
Required by Gmail & Yahoo senders (Feb 2024)

How the two-way check works

Plain reverse DNS answers only half the question. A spammer can point a PTR at any hostname they like, even one they do not control. FCrDNS closes that loophole by confirming the relationship from both ends:

  • Reverse: look up the PTR record for the sending IP 203.0.113.10. It returns mail.example.com.
  • Forward: now look up the A record for mail.example.com. It must resolve back to 203.0.113.10.

If both agree, the IP passes FCrDNS, sometimes called a “full circle” or iprev check. Because the PTR and the A record are controlled by different parties (the IP owner and the domain owner), a match is meaningful evidence that the sender legitimately controls both.

The two lookups that make up an FCrDNS check, and they must agree 
# Reverse: IP to hostname (PTR)
$ dig -x 203.0.113.10 +short
mail.example.com.

# Forward: hostname back to IP (A), must match the IP above
$ dig A mail.example.com +short
203.0.113.10

Why FCrDNS is now mandatory

FCrDNS has been a quiet deliverability factor for decades, but it became a hard requirement in February 2024, when Google and Yahoo updated their sender rules. Both now state that a sending IP must have a PTR record that resolves to a hostname, and that hostname must have a forward record resolving back to the same IP. Fail the round trip and bulk mail is rejected or filtered, regardless of how clean your SPF and DMARC are.

The fix has two halves owned by two parties. The reverse half (the PTR) is set by whoever owns the IP, usually your host or ESP. The forward half (the A record) lives in your own DNS. Both must name the same hostname and the same IP. Verify the full circle with our reverse DNS checker before you scale up sending.

The FCrDNS round trip

Receiver takes the sending IP 203.0.113.10
Reverse lookup: the PTR returns mail.example.com
Forward lookup: does mail.example.com resolve back to 203.0.113.10?
Matches: FCrDNS passes Different IP or no record: fails
On a match the IP is trusted; on a mismatch it is penalised
Mail from a passing IP is judged on its other merits

Reverse DNS vs FCrDNS

Reverse DNS only FCrDNS
Checks IP to hostname IP to hostname and back
Records used PTR PTR + A/AAAA
Spoofable? A lone PTR can point anywhere No, both ends must agree
Required by Gmail / Yahoo Not on its own Yes, since Feb 2024

By the numbers

2
DNS lookups that make up the check: one reverse (PTR), one forward (A/AAAA), and they must match.
Feb 2024
When Gmail and Yahoo made forward-confirmed reverse DNS mandatory for senders.

Common mistakes

Setting the PTR but not the matching A record
FCrDNS needs both halves. If the hostname in your PTR has no forward record, or one that points to a different IP, the round trip fails even though the PTR looks fine.
Using a hostname you do not control
Pointing your PTR at someone else’s domain means you cannot create the matching forward record, so the check can never pass. Use a hostname under a domain you manage.
Assuming SPF and DKIM cover it
Authentication and FCrDNS are separate tests. You can pass SPF, DKIM, and DMARC perfectly and still be rejected for failing the forward-confirmed reverse DNS round trip.

Frequently asked questions

What is FCrDNS?
Forward-confirmed reverse DNS is a two-way validation of a sending IP. The IP’s PTR record must resolve to a hostname, and that hostname’s A or AAAA record must resolve back to the same IP. Only when both directions agree does the IP pass, which is strong evidence the sender controls both.
Why do Gmail and Yahoo require FCrDNS?
It is hard to fake. The PTR is set by the IP owner and the forward record by the domain owner, so a clean match shows a real, configured mail server rather than a hijacked or throwaway one. Since February 2024 both providers require it on every sending IP for bulk mail.
How do I pass an FCrDNS check?
Ask your host or ESP to set the IP’s PTR to a hostname you control, such as mail.example.com, then add an A (or AAAA) record for that hostname pointing back to the same IP. Confirm both directions agree with a reverse DNS checker.
Reviewed by Jennifer Jackson, Email Deliverability Analyst · June 2026 ← Back to glossary