What is FCrDNS (forward-confirmed reverse DNS)?

By Nik Andreev, Founder & SEO specialist · Last reviewed · Editorial policy

FCrDNS (forward-confirmed reverse DNS) verifies an IP by making two DNS records agree. You look up the IP's PTR record to get a hostname, check the hostname belongs to the operator, then look up that hostname and confirm it returns the original IP. The forward record is controlled by the real domain owner, so a forged PTR record cannot pass.

Full guide Reverse DNS lookup: how bot verification actually works A full FCrDNS walk-through against a Googlebot IP, the suffix mistakes to avoid, and what to pair it with. Read the guide →

At a glance

Steps
Reverse lookup (PTR), domain suffix check, forward lookup (A or AAAA) back to the same IP
Documented by
Google for its crawlers, Bing for Bingbot
Accepted domains (Googlebot)
googlebot.com or google.com
Accepted domain (Bingbot)
search.msn.com
Why it works
The IP owner sets the PTR. Only the domain owner can make the forward record match.
Limit
Only works for operators that publish reverse DNS for a domain they own

How to run it

  • Reverse: resolve the IP to a hostname. No PTR record means FCrDNS cannot vouch for it.
  • Match: the hostname must end in an accepted domain for that operator. Compare the end of the string, so googlebot.com.example.net fails.
  • Forward: resolve the hostname and confirm the original IP is in the answer. A different IP means the PTR record was forged.
host 66.249.66.1
# 1.66.249.66.in-addr.arpa domain name pointer crawl-66-249-66-1.googlebot.com.
host crawl-66-249-66-1.googlebot.com
# crawl-66-249-66-1.googlebot.com has address 66.249.66.1   (match: verified)

Other ways to verify a bot

Reverse DNS lookup The first half of FCrDNS, and why it is not enough on its own. Published IP ranges Match the IP against a list the operator publishes. No live DNS needed. Signed agent Proves identity with a signature instead of the network.

Quick answers

Should I accept googleusercontent.com hostnames?

Not for Googlebot. Google uses that domain for some user-triggered fetchers, but ordinary Google Cloud machines also resolve under it and forward-confirm.

Is FCrDNS slow?

It costs two DNS queries per new IP. Cache results, or use the operator's published IP ranges, to keep it off the hot path.

What if the reverse lookup returns nothing?

FCrDNS cannot verify that IP. It is not proof of a fake. Fall back to published IP ranges or a signature.

Sources