rDNS involves searching domain name registry and registrar tables.
The modern "reverse DNS lookup" should not be confused with the now-obsolete "inverse query" (IQUERY) mechanism specified in RFC 1035: Inverse queries take the form of a single resource record (RR) in the answer section of the message, with an empty question section.
The owner name of the query RR and its time to live (TTL) are not significant.
[2]The IQUERY message type was always "optional"[2] and "never achieved widespread use";[3] it was "permanently retired"[3] in 2002 with the adoption of RFC 3425.
It is important to note that this is the reverse order to the usual dotted-decimal convention for writing IPv4 addresses in textual form.
For example, to do a reverse lookup of the IP address 8.8.4.4 the PTR record for the domain name 4.4.8.8.in-addr.arpa would be looked up, and found to point to dns.google.
An IPv6 address appears as a name in this domain as a sequence of nibbles in reverse order, represented as hexadecimal digits as subdomains.