The reverse-DNS-only Googlebot check that misses the second hop

The reverse-DNS-only Googlebot check that misses the second hop

Most "verify Googlebot" snippets stop too early. Hand-picked reads on doing it right:

→ Google Search Central docs — Why the rule is forward-confirmed reverse DNS, not just a PTR lookup. The PTR alone is spoofable; you must re-resolve the hostname back to the original IP.
Takeaway: run host 66.x.x.x, then host the-result.googlebot.com and confirm the A record matches the source IP.

→ Stack Overflow (webmasters) — Common failure: trusting a PTR that ends in .googlebot.com without the round trip.
Takeaway: a faked rDNS gets you a hostname, not a matching forward record.

★ Pick of the week — Google's IP ranges JSON — Google now publishes googlebot.json. Verify against the CIDR list and skip DNS round trips at scale.
Takeaway: cache the ranges, refresh weekly, match by subnet.