Helo Command Rejected: How to Set Your Mail Server's HELO Hostname (Postfix, Exim, Exchange)

A "Helo command rejected" error means the receiving server didn't like the name your server introduced itself with. Set the HELO to a fully qualified hostname such as mail.example.com, give that name an A record pointing at the sending IP, and set the IP's PTR to the same name. Then send a test message to an outside inbox and read the Received header to confirm what the server really announces.

This is a server setting, not a list problem. A HELO rejection says nothing about whether the recipient exists, so don't delete addresses because of it. Spamhaus is also rolling out a HELO and reverse DNS requirement from November 2026; our post on the Spamhaus HELO and PTR requirement covers what it asks for. This post is the hands-on fix.

Read the error first

The two common versions come from Postfix's HELO restrictions on the receiving side:

Error	Postfix restriction	Default code	What it means
504 5.5.2 <localhost>: Helo command rejected: need fully-qualified hostname	reject_non_fqdn_helo_hostname	504 (permanent)	The name has no domain part
450 4.7.1 <...>: Helo command rejected: Host not found	reject_unknown_helo_hostname	450 (temporary)	The name has no A or MX record
501 ... Helo command rejected: Invalid name	reject_invalid_helo_hostname	501 (permanent)	The name is malformed

Our SMTP 504 page has more examples of the first one. A related rejection, 550 5.7.25, is about the IP having no PTR record rather than the HELO.

Step 1: Find what your server announces

Don't trust the config file alone; a container, relay or second transport may override it.

1. Send a message from the server to an outside mailbox you control.
2. Open the message's full headers. The Received header added by the receiving server reads something like Received: from mail.example.com (mail.example.com [203.0.113.25]). The first name after from is the HELO; the IP in square brackets is the sending IP.
3. Paste that Received line into the HELO hostname checker. It reads the HELO and IP from the line and runs the DNS checks.

The email header analyzer is useful if the header is long and you want the hops laid out.

Step 2: Change the HELO name

Postfix. The SMTP client announces smtp_helo_name, which defaults to $myhostname. Set either in /etc/postfix/main.cf:

myhostname = mail.example.com
# or, to change only what the client announces:
smtp_helo_name = mail.example.com

Run postfix reload. If you send from several IPs with separate transports in master.cf, check each one for its own -o smtp_helo_name= override.

Exim. The smtp transport uses helo_data, which defaults to the server's primary hostname. Set primary_hostname = mail.example.com in the main config, or helo_data = mail.example.com on the transport, then restart Exim.

Exchange Server. The name comes from the send connector's FQDN. In the Exchange admin center, open the send connector and set the FQDN, or run Set-SendConnector "Internet" -Fqdn mail.example.com in the Exchange Management Shell.

Apps and appliances. Printers, CRMs and scripts that send SMTP directly usually have a "HELO" or "local hostname" field in their SMTP settings. If it's empty, many default to the machine name, which is how localhost and DESKTOP-1234 end up in HELO.

Step 3: Make the DNS match

1. A record: in your domain's DNS, add an A record for mail.example.com pointing at the sending IP (and AAAA if you send over IPv6).
2. PTR record: ask whoever owns the IP, usually your hosting or cloud provider, to set the IP's reverse DNS to mail.example.com. You can't set it in your own DNS zone. Check it with the reverse DNS lookup.
3. Forward-confirm: the PTR name's A record should point back to the same IP. Our post on PTR records for email covers this with dig commands.

RFC 5321 only requires the HELO to be the client's fully qualified domain name (or an address literal). The matching PTR is what Spamhaus's sender guidelines and its listing checks ask for, and it leaves nothing for a receiver to question.

Step 4: Confirm it

Send another test to an outside inbox and read the new Received header. The HELO should be mail.example.com, and the HELO hostname checker should pass on the A record, the PTR and the forward-confirmation. DNS changes can take up to the record's TTL to be seen.

Mistakes that keep the error coming back

• The bare domain as HELO (example.com), when its A record points at the website.
• The provider's default name (vps12345.provider.net) as HELO while the PTR says something else.
• A private suffix such as .local or .lan.
• Several HELO names for one sender. Spamhaus says multiple HELO values resolving to different IPs "may indicate residential proxy and/or malware behaviour".
• A fixed HELO with a blocklisted IP. The names lining up doesn't make the IP trusted; run the IP blacklist check too.

Where SimpleVerifier fits

The HELO checker, reverse DNS lookup and header analyzer are free. SimpleVerifier's paid part is list verification, which keeps bounces down once mail is flowing; it doesn't configure your server. The first 100 checks are free with a Google sign-in on the verify page. Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off. See pricing.