Spamhaus HELO and Reverse DNS Requirement (November 2026): What to Check
From November 2026, Spamhaus is gradually requiring every sending IP to have a valid HELO, a reverse DNS (PTR) record and a matching A record. In practice that's three checks: the IP's PTR record names a hostname, that hostname resolves back to the same IP, and the hostname your server announces in HELO/EHLO resolves to the sending IP too. If you send through a shared ESP, the ESP handles this. If you run your own mail server, a VPS or a dedicated IP, check it now.
The note sits at the top of the new Spamhaus Sender Guidelines (read 2 November 2026): "Starting in November 2026, we are gradually rolling out a requirement for every sending IP to have a valid HELO, a reverse DNS (PTR) record, and a matching A record." Spamhaus points senders to its HELO checker and says to follow the guidelines "to avoid being listed".
Who this affects
| How you send | Who owns the IP's PTR and HELO | What you check |
|---|---|---|
| Shared ESP (Mailchimp, Brevo, SES shared IPs) | The ESP | SPF, DKIM, DMARC on your domain |
| Google Workspace or Microsoft 365 | Google or Microsoft | Same |
| Dedicated IP at an ESP | ESP, sometimes with your hostname | That the rDNS resolves, using the ESP's setup |
| Your own server (Postfix, Exim, PowerMTA) on a VPS or bare metal | You and your hosting provider | All three checks below |
| An app sending SMTP directly from a cloud instance | You | All three, and whether the provider allows port 25 at all |
The three checks
- PTR exists and names a real hostname. Look up the sending IP with the reverse DNS lookup. It should return a fully qualified name on your domain, such as
mail.example.com, notip-203-0-113-7.provider.net. Spamhaus: "Do not use generic or auto-generated rDNS entries for dedicated IPs that point to the hosting provider". - The PTR name resolves back to the same IP. Look up the A (or AAAA) record of that hostname with the DNS lookup. Spamhaus: "Ensure the rDNS hostname resolves to the connecting IP address via a corresponding forward DNS (A/AAAA) record." This is forward-confirmed reverse DNS.
- The HELO name resolves to the sending IP. Find the hostname your server announces (Postfix:
myhostname; most MTAs log it, and it's in theReceived:header receivers add). It must resolve to the sending IP. Spamhaus: "Where possible, ensure the HELO/EHLO hostname is consistent with the rDNS hostname."
The simplest setup that passes all three: one hostname, say mail.example.com, with an A record pointing to the IP, a PTR on the IP pointing to mail.example.com, and the server announcing mail.example.com in HELO.
Common mistakes Spamhaus names
- Placeholders. "Do not use placeholder values such as localhost or generic hostnames that point to the hosting company/ISP as the HELO value."
- Several HELO names for one sender. "Multiple HELO values resolving to different IP addresses may indicate residential proxy and/or malware behaviour."
- HELO pointing elsewhere. "Do not resolve HELO hostname to infrastructure that is not used for sending".
- No PTR at all. Spamhaus "will treat emails originating from IP addresses without rDNS as suspicious".
- IPv6 without rDNS, or allocations smaller than /64.
PTR records are set by whoever controls the IP, usually in your hosting provider's panel or through a ticket, not in your domain's DNS. Our post on PTR records for email covers who can change it and how to check it with dig, and cloud providers that block port 25 covers the other common blocker for self-hosted senders.
After the DNS is right
Fixing rDNS and HELO doesn't clear an existing listing. If the IP is already listed, check it with the IP blacklist check and follow the list's own removal steps; see Spamhaus listings explained. The rest of the guidelines (confirmed opt-in, bounces under 5%, unsubscribes within 2 days) are summarised in our Spamhaus sender guidelines checklist.
Where SimpleVerifier fits
The DNS tools linked above are free. SimpleVerifier's paid part is list verification, which keeps bounces under the 5% line in the same guidelines; it doesn't set or monitor your DNS. The first 100 checks are free with a Google sign-in on the verify page. Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off, and one-time packs of 10,000 checks for $15 never expire. See pricing.
Common questions
What is a valid HELO for Spamhaus?
A fully qualified hostname that resolves to the IP the mail is sent from, used consistently, and ideally the same as the reverse DNS name. Spamhaus says not to use placeholders such as localhost or generic hostnames that point to the hosting company.
Do I need to do anything if I use Mailchimp, SES or Google Workspace?
For the sending IPs, no: the provider runs them and sets their PTR and HELO. Your part is SPF, DKIM and DMARC on your domain. If you have a dedicated IP at an ESP, check that its reverse DNS uses a name the ESP supports and that it resolves.
How do I set a PTR record?
PTR records are set by whoever controls the IP address, usually your hosting or VPS provider, not in your domain's DNS. Most providers have a reverse DNS field in the server's network settings, or set it through a support ticket.
What happens if my IP doesn't meet the requirement?
Spamhaus says it will treat mail from IPs without rDNS as suspicious, that this shows in the IP's reputation, and that receivers using Spamhaus data may filter it further. It says to follow the guidelines 'to avoid being listed'. It hasn't published a firm cut-off date beyond the gradual November 2026 start.
Check your list before you send
Real mailbox checks over SMTP, and nothing is sent to the address. Sign in with Google and your first 100 email checks are free, no card. Plans for bigger lists are on the pricing page.