At a glance
- Provider
- AT&T Internet
- Category
- US Residential
- Country/Region
- United States
- Known ASNs
- AS7018
AT&T Internet network profile
US Residential provider in United States. National fixed network footprint with fiber and DSL deployments.AT&T Internet is one of the major US Residential providers tracked in this directory, with operations in United States. This profile page covers AT&T Internet's primary ASN references (AS7018), common coverage locations, and the diagnostic context most useful when an IP lookup, ASN result, or traceroute attributes a public address to AT&T Internet. Use it as a starting point for ASN, WHOIS, and reverse DNS validation rather than as a standalone proof of identity or location.
How to use this page
Use this profile when an IP lookup shows AT&T Internet or a related ASN. It gives quick context before deeper routing and ownership checks.
- Map the IP to ASN in the ASN lookup tool.
- Validate reverse DNS and WHOIS ownership details.
- Compare with blacklist status for reputation checks.
Common coverage locations
AT&T Internet ASN references
AT&T Internet investigation notes
US residential broadband networks usually rely on dynamic address pools and metro-level aggregation, so a provider match is often stronger than an exact city label.
AT&T Internet results should be separated from other AT&T-branded network families by confirming AS7018 first, then checking whether PTR and WHOIS fit fixed broadband rather than mobility or backbone context.
- Treat residential ISP matches as provider context, not proof of one subscriber, building, or precise neighborhood.
- Start with AS7018 as the expected ASN family before assuming the provider result is final.
- When the decision is important, combine AT&T Internet with reverse DNS, WHOIS / RDAP, and blacklist context instead of relying on one data source.
Best follow-up checks
AT&T Internet troubleshooting workflow
Start with IP to ASN mapping, then verify reverse DNS and WHOIS ownership. For email and abuse workflows, add blacklist checks to assess IP reputation signals around AT&T Internet traffic.
Related tools
AT&T Internet: the largest US fiber buildout under one brand
AT&T Internet is the consumer broadband arm of AT&T Inc., headquartered in Dallas, Texas. The current corporate identity emerged from SBC Communications’ 2005 acquisition of the original AT&T Corporation, with SBC renaming itself AT&T Inc. and absorbing the legacy network. The 2006 BellSouth acquisition further expanded the southeastern footprint. Today AT&T operates the largest fiber-to-the-home (FTTH) deployment in the United States by passings, with AT&T Fiber available across roughly 20 million addresses and continuing to expand aggressively.
The consumer broadband product mix on AT&T addresses today is more fragmented than competitors’ because the network has been actively transitioning between several underlying technologies. AT&T Fiber provides symmetric multi-gigabit service over FTTH. AT&T Internet (formerly branded U-verse) is the legacy VDSL over FTTN/FTTC product with asymmetric speeds. Pure DSL still exists in pockets of the footprint where neither upgrade has reached. AT&T Internet Air is the newer fixed-wireless product riding on 5G cellular. Each tier produces different IP-level behavior, so AT&T attribution requires service-tier awareness in addition to provider identification.
AS7018, AS2386, and the AT&T routing architecture
The dominant ASN for AT&T residential broadband and small business traffic is AS7018, registered as AT&T Services. AS7018 inherits the backbone identity from the original AT&T Communications and now carries an enormous portion of US residential broadband traffic. AS2386is AT&T Data Services, used for enterprise and dedicated allocations. AS20057is AT&T Mobility, used for wireless traffic - including AT&T Internet Air fixed wireless customers whose home broadband actually rides on the cellular network.
The multi-ASN structure means an AT&T residential broadband lookup typically returns AS7018, but a business-tier or fixed-wireless lookup may return a different ASN under the same overall brand. Cross- checking through ASN Lookup identifies which AT&T service category an IP represents. The ASN landscape is particularly important for distinguishing AT&T Fiber from AT&T Internet Air, because the two products serve overlapping markets with very different underlying behavior - and they don’t all announce from AS7018.
Fiber, U-verse legacy, DSL, and Internet Air: four networks under one brand
The technology mix on AT&T residential addresses produces meaningful differences in lookup interpretation. AT&T Fiber subscribers have symmetric upload and download capacity (sometimes up to 5 Gbps in pilot markets), low latency, mature IPv6 deployment, and stable IP assignments. Their traffic patterns can sustain heavy upstream activity that residential broadband on other technologies cannot.
U-verse legacy lines run VDSL2 over FTTN architecture, providing asymmetric service with much lower upload capacity. These customers’ networks behave more like traditional DSL with concentration at neighborhood cabinets. Pure DSL ranges still exist in remote portions of the footprint with even more limited upload. AT&T Internet Air, the 5G fixed-wireless product, behaves like cellular service: traffic announces from cellular ASN context, geolocation is tower-area precision, and CGNAT-style source-port distribution is common. The same physical neighborhood can contain customers on all four technologies, which is why service-tier inference from IP signals is more diagnostic than the city label alone.
PTR conventions and the SBCglobal.net legacy
AT&T PTR patterns reflect the SBC and BellSouth merger lineage more than any other major US ISP. Legacy residential ranges resolve under the sbcglobal.netdomain that AT&T inherited from SBC Communications. Common patterns include adsl-IP.dsl.market.sbcglobal.net wheremarket is a three-to-six character market identifier. U-verse VDSL lines often resolved withuverseor specific market codes embedded in the hostname. AT&T Fiber ranges allocated more recently use cleaner naming conventions without the extensive legacy market identifiers, often resolving under the att.net family of domains.
The PTR diversity affects investigation workflows. A hostname with sbcglobal.net almost always indicates a long-tenure subscriber on legacy DSL or U-verse infrastructure. A hostname underatt.netwithout legacy SBC markers typically represents Fiber or newer Internet service. Newer fiber-only ranges may have minimal reverse DNS at all - AT&T has been less aggressive than Comcast at configuring detailed residential PTR records on its newest allocations. Cross-checking PTR patterns with the announcing ASN and current WHOIS / RDAP through WHOIS / RDAP Lookup produces the most reliable AT&T service-tier identification.
Email reputation and AT&T outbound mail policy
AT&T applies port 25 blocking on residential lines consistent with industry practice across the major US ISPs. Residential AT&T Internet customers (including Fiber) cannot send direct outbound SMTP on port 25; the traffic is blocked at the access network. Business accounts can request unblocking and run legitimate outbound mail relays. The structural implications for mail forensics match Comcast and Charter: mail logged from an AT&T residential IP via port 25 should be treated as misattributed or originating from an authenticated relay or compromised endpoint using non-standard ports.
AT&T residential reputation is generally cleaner than the historical baseline for ranges inherited from the SBC era, partly because the network has been actively migrating customers to fiber (which carries different demographic patterns than legacy DSL) and partly because AT&T’s abuse handling has matured over the past decade. AT&T also operates feedback loops and postmaster resources that mail operators can use to monitor reputation and respond to complaints. Specific IP reputation should be validated through IP blacklist check against current blocklists rather than assumed from historical patterns.
IPv6 deployment by service tier on AT&T
AT&T’s IPv6 deployment has been technically capable but unevenly executed across the residential footprint. AT&T Fiber subscribers generally receive IPv6 prefix delegation alongside their IPv4 address. U-verse and DSL ranges have more variable IPv6 readiness - some lines have IPv6 enabled, others remain IPv4-only despite the network being technically capable, depending on customer-premises equipment and provisioning history. AT&T Internet Air customers typically receive IPv6 through cellular network mechanisms, which produces different IPv6 address patterns than the residential broadband allocations.
The unevenness has practical lookup implications. An IPv6 lookup of an AT&T address that returns no IPv6 data does not necessarily indicate a VPN is working - it may simply mean the line is on IPv4-only legacy infrastructure with no IPv6 present in the first place. Privacy investigations on AT&T should establish whether IPv6 exists on the specific line before interpreting "no IPv6 detected" as a positive signal about VPN configuration. Our IPv6 leak test is the cleanest way to make this determination on a specific AT&T connection.
AT&T Internet Air: fixed wireless and cellular attribution
AT&T Internet Air launched in 2023 as a fixed wireless home broadband product delivered over AT&T’s 5G cellular network. The product serves customers in areas where wireline service is unavailable or undesired. Its IP-level behavior is distinctly cellular rather than wireline: traffic announces from AT&T Mobility (AS20057) rather than from the residential AS7018 footprint, source-port distribution shows CGNAT-style patterns indicating shared public IPs, and geolocation precision is tower-area rather than street-level.
The lookup implication is that AT&T addresses announcing from AS20057 with CGNAT-style behavior and no consistent residential PTR pattern are very likely Internet Air installations rather than misconfigured Fiber or U-verse accounts. For investigators, this distinction matters because Internet Air customers produce different traffic signatures than wireline customers - more variable latency, different upload behavior, less stable IP assignment. Treating an Internet Air IP as if it were Fiber will produce attribution errors that wireline-style assumptions cannot accommodate. The ASN check is the cleanest disambiguator.
AT&T DNS resolver behavior and customer-router DNS practices
AT&T historically pushes its own DNS resolvers heavily on residential connections. The default residential gateway is provisioned to use AT&T- managed recursive resolvers, with the IPs varying by market and provisioning era. Common AT&T resolver addresses include 68.94.156.1, 68.94.157.1, and regional variants. The practical implication is that an AT&T residential subscriber’s DNS queries flow through AT&T infrastructure unless they explicitly override the resolver in their router or device settings - which most users never do.
The DNS-default behavior matters for VPN privacy specifically. A VPN that does not capture DNS queries on an AT&T residential line leaves them flowing to AT&T resolvers, producing the classic DNS leak pattern. The leak is especially common on U-verse and older AT&T routers where the customer-premises equipment enforces AT&T DNS at the gateway level regardless of device-level settings. AT&T Fiber customers using their own router behind the AT&T ONT have more flexibility to configure custom DNS, but the default Fiber gateway still defaults to AT&T resolvers. Our DNS leak test is particularly diagnostic on AT&T because the default-resolver behavior is so widespread - leaks here are common and easy to detect, while clean tunneling indicates a deliberately configured VPN that overrides the access network defaults.
AT&T lookup limits and the multi-service-tier caveat
The biggest specific limit on AT&T residential IP attribution is the service-tier ambiguity. A single AS7018 lookup result does not tell you whether the subscriber is on Fiber, U-verse legacy, pure DSL, or Internet Air without additional context from PTR patterns, source-port behavior, or upload-volume signals. The tiers differ enough in real-world behavior that conflating them produces meaningful attribution errors for any workflow that depends on service-tier specifics - performance expectations, IPv6 readiness, CGNAT presence.
Beyond the service-tier issue, AT&T residential IPs share the same single-household limitation common to all residential broadband. The address represents the subscription, not any individual person inside the household. The footprint also includes substantial business customers reassigned addresses inside what would otherwise be consumer ranges, which can produce lookups where the WHOIS record points to a customer organization rather than AT&T itself. Treating AT&T attribution as layered context - ASN, PTR, WHOIS, geolocation, service-tier inference - produces more reliable identification than any single signal in isolation. For consequential decisions, the IP lookup is a starting point that needs corroboration through other evidence sources.
AT&T enterprise services, dedicated allocations, and support paths
AT&T Business operates a substantial enterprise services business under what was historically AT&T Communications. Dedicated Internet, MPLS, SD-WAN, and cloud connectivity products serve mid-market and enterprise customers across the same fiber backbone that supports consumer AT&T Fiber. Enterprise allocations typically announce from AS2386 or custom customer-assigned ASNs rather than from the consumer AS7018. Customer-edge BGP, static IPv4 and IPv6 allocations, and direct peering relationships are standard on the enterprise tier - all behaviors that consumer Fiber and U-verse do not exhibit.
For abuse and reputation paths, AT&T maintainsabuse@att.net as the primary residential abuse contact and separate enterprise abuse paths for business customers. The abuse-att@att.compath serves the enterprise side and routes to the specific account team for managed customers. Mail reputation issues with AT&T residential ranges typically resolve through the standard blocklist delist workflows rather than direct AT&T action, since the residential customer does not control the underlying IP allocation. For business customers with static allocations, AT&T can coordinate PTR alignment and support delist evidence packages. Our blacklist check alongside service-tier confirmation through ASN and PTR examination identifies which path applies to a specific AT&T-attributed IP.
Quick reference summary for AT&T Internet lookups
The high-confidence AT&T identification recipe is AS7018 (consumer) or AS2386 (enterprise) plus ansbcglobal.net or att.netfamily PTR pattern plus a US metro geolocation in the AT&T footprint. Service-tier inference is the most important AT&T-specific layer because Fiber, U-verse legacy, pure DSL, and Internet Air all share the AT&T brand but behave differently at the IP level. Internet Air customers specifically announce from AT&T Mobility (AS20057) with CGNAT-style behavior - distinct from wireline AT&T Internet despite being marketed under the same residential brand. IPv6 readiness varies by service tier and provisioning history. AT&T pushes its own DNS resolvers heavily on residential lines, making DNS leak testing particularly diagnostic for VPN setups on this network. Treat AT&T attribution as a starting point for further inquiry rather than as a conclusion - service-tier ambiguity alone produces enough attribution noise that single-signal analysis routinely misses important context.
For deeper market-level context on AT&T’s largest fiber rollout markets, pair this provider profile with our enriched city page for AT&T Internet San Antonio - the San Antonio market is one of AT&T’s flagship fiber buildouts and contains the most concentrated examples of the service-tier mix (Fiber, U-verse, Internet Air) described in this profile. For everyday IP lookup workflows, the provider profile alone is sufficient; for metro-specific investigations, the paired city page adds operational local-market context that the company-wide description cannot fully capture.
AT&T Internet FAQ
What ASN does AT&T Internet use?
AT&T Internet may use one or multiple ASNs depending on region and service type. This page lists common references for quick investigation.
Can AT&T Internet IP addresses change location results?
Yes. Geolocation can vary by database and routing design, especially on mobile or CGNAT-heavy networks.
How should I verify ISP ownership?
Cross-check ASN mapping with WHOIS/RDAP and reverse DNS to reduce false assumptions from one data source.
Is AT&T Internet enough to identify an exact user location?
No. The ISP name is provider context. Exact location and subscriber-level identity require stronger evidence than public lookup data can provide.
Why do AT&T Internet lookup results sometimes show nearby cities?
Provider aggregation, dynamic address pools, mobile gateways, and stale geolocation records can all make a correct ISP match appear under a nearby city.