For my web app, I hardcode a reverse DNS detection for common web crawlers. And for detecting them I use their Reverse DNS, which I always check whether it includes i.e. google.com. My questions would be:
- Can this be a possible security flaw, because a subsubdomain could be just named
- Can the Reverse DNS be spoofed using IP spoofing?
- In case of yes to the previous question, how can I check that it was legit? Do I need to implement code to ping that IP or something?