Is that request really Googlebot?

How the check works

There are two methods, and each operator documents one of them.

Forward-confirmed reverse DNS

A reverse lookup turns the address into a hostname. If that hostname sits under a domain the operator claims, a second lookup resolves it forward and has to return the address you started with. That second step is the one that matters. Anyone can publish a reverse record saying they are Googlebot; only the real owner of the address can make the forward lookup agree.

Used here for Google, whose crawlers resolve under googlebot.com, google.com. Google's page also names googleusercontent.com, and this check does not accept it: every Google Cloud customer machine resolves under that domain, so it tells you who hosts the address, not who sent the request. The fake Googlebot guide walks through the same checks by hand.

Published address ranges

Operators whose crawlers have no reverse DNS instead publish a machine-readable list of the addresses they crawl from. The check fetches those lists and tests whether the address falls inside one of them.

What a result does and does not tell you

A match means the operator's own published evidence accounts for the address. It says nothing about whether the request was welcome, whether it read your robots.txt, or what it did once it arrived.

No match is weaker than it looks. Most addresses on the internet belong to nobody on this list, and that is the normal case rather than a finding. The answer worth acting on is the mismatch: a header naming an operator whose own evidence does not back it up. Those are common: on the median site in our crawler verification data, 1 in 7 requests calling itself Googlebot did not come from Google.

Identity is also not authorization. A verified crawler is still a crawler you may or may not want on a given route. For turning a confirmed identity into an access decision, read verifying AI agents. For what a crawler policy can and cannot enforce, read the robots.txt guide.

Where each operator publishes its crawler IPs

This table lists every crawler in the bot directory whose operator documents a way to verify it, with the reverse DNS domains or address list the operator names. Checked against each operator's own documentation on 2026-09-30.

Sources this checks

Every source is the operator's own. None of it is a Centinel list, so you can check any answer here against the same file.

• Google crawler verification (reverse DNS)
• OpenAI: GPTBot (published ranges)
• OpenAI: OAI-SearchBot (published ranges)
• OpenAI: ChatGPT-User (published ranges)
• Anthropic: ClaudeBot and its other crawlers (published ranges)
• Perplexity: PerplexityBot (published ranges)

Bingbot is missing. Its verification page would not load when this was built, and a rule nobody confirmed is worse inside a verification tool than no rule at all.