How are DNS PTR records managed?

Solution 1:

or are they stoerd in separate zones?

Separate zones, one per old C network (last byte in the octet).

What stops me from adding a PTR record saying that resolves to say gmail.com?

Nothing. But as this is not used exceptt for nice pings or some email validity checks, you achieved nothing. people will still go to gmail when they type in gmail.com. All people now see is gmail.com in a traceroute, nothing else.

The one real use for this is smtp - the HELO string given in SMTP should match the PTR record name given. Basically the server must say it is who the ptr record says it is. Note that it can still accept emails for other domains.

Solution 2:

If you have a zonefile for example.com with:

www.example.com  300  IN  A  16.24.32.40

Then you would have a zonefile for 32.24.16.in-addr.arpa with:

40.32.24.16.in-addr.arpa  300  IN  PTR  www.example.com