Reverse DNS (PTR) for mail servers: what it is and how to set it up correctly
A missing or wrong reverse DNS record is one of the most common reasons why emails from your own server are rejected. Gmail now rejects emails without a valid PTR record. What reverse DNS is, what it should look like and where you set the record.
What reverse DNS is
Normal DNS answers the question “Which IP belongs to mail.example.com?”. Reverse DNS answers the opposite question: “Which name belongs to the IP 203.0.113.10?”. The answer is stored in a PTR record:
10.113.0.203.in-addr.arpa. PTR mail.example.com.
The IP is written backwards under in-addr.arpa (for IPv6 under ip6.arpa). All that matters for you: every IP you send email from needs exactly one such record.
Why mailbox providers care
A receiving server first sees the IP connecting to it. A large share of spam comes from hijacked home computers and cheaply rented servers. These almost never have a clean name. A matching reverse DNS record, on the other hand, shows: someone is deliberately running a mail server here.
- Gmail requires valid forward and reverse records from all senders and otherwise rejects with the error
550 5.7.25. - Many other servers add spam points for missing or generic names like
static-203-0-113-10.provider.example.
What it should look like
A correct record meets three conditions:
- There is a PTR record for the sending IP.
- The name points back to the same IP. This is called forward-confirmed reverse DNS (FCrDNS):
mail.example.comhas an A record (or AAAA) with exactly this IP. - The name is not a generic provider name but the name of your mail server. Ideally the same name your server uses in the SMTP conversation (HELO or EHLO).
| Situation | Rating |
|---|---|
PTR mail.example.com, A record points back, HELO mail.example.com | Ideal |
PTR mail.example.com, but no A record for it | Not confirmed – often treated as missing |
PTR static-203-0-113-10.provider.example | Generic – looks like a dial-up or cheap server |
| No PTR record | Gmail rejects, many others penalize heavily |
By the way, the name doesn't have to match the domain in the sender address. A server mail.example.com may send emails for many domains – that's what SPF and DKIM are for.
Where you set the PTR record
This is the most common source of confusion: the PTR record is not set by whoever manages the domain, but by whoever owns the IP address. That's your hosting provider or data center, not your domain registrar.
- For servers and VMs, you'll usually find the setting in the customer area under “Reverse DNS”, “rDNS” or “PTR”.
- If there's no field for it, a short message to support with the IP and the desired name helps.
- With an internet connection with a changing IP, you can't set your own PTR. Send via your provider's mail server or a sending service instead.
Order: first create the A record (or AAAA) for the name, then the PTR. Some hosts check whether the name already points to the IP when setting it.
Special case IPv6
If your server has an IPv6 address, it often prefers to send emails to large providers over it. Then the IPv6 address also needs a PTR record with a matching AAAA record. This is often forgotten: everything works over IPv4, but over IPv6 Gmail rejects.
If you can't set up IPv6 sending properly, configure your mail server to send over IPv4 only (for Postfix, for example, inet_protocols = ipv4).
How to check it
On the command line:
dig -x 203.0.113.10 +short → mail.example.com. dig mail.example.com A +short → 203.0.113.10
Both answers must match. It's easier with the test on the home page: Postwacht checks reverse DNS, the forward confirmation and the HELO name on a real email – i.e. with exactly the IP your server actually sends from.