Spamhaus will enforce HELO, PTR and A-record checks from November 2026: what to check now

What Spamhaus announced

On 21 October 2026, Spamhaus published its Sender Guidelines. The page combines advice that was previously spread across Spamhaus FAQs, blog posts and support replies. Spamhaus says these are not new rules: the guidance comes from internet standards, mailbox-provider practices and what responsible senders already do. ^[1]

The part with a deadline is about DNS. Spamhaus says that, starting in November 2026, it will gradually enforce basic DNS requirements over several months. Every sending IP will need a valid HELO, a reverse DNS (PTR) record and a matching A record. ^{[1] [2]} The announcement also explains why: an invalid HELO, a missing PTR or a missing matching A record is one of the most common reasons for a listing. A poorly configured server can look like a compromised server or a spammer. ^[1]

Three records, one sending identity

When your mail server connects to another mail server, it introduces itself with a hostname in the HELO or EHLO command. The receiving server can also see the IP address the connection came from. A PTR record answers one question: which hostname belongs to this IP? An A record (or AAAA for IPv6) answers the reverse question: which IP does this hostname point to?

Spamhaus’s minimum requirement is forward-confirmed reverse DNS. The PTR for the sending IP must point to a fully qualified hostname, and that hostname must point back to the same IP. The HELO/EHLO name must also resolve to the sending IP, and it must stay the same on every connection from that IP. ^[2] Where possible, Spamhaus recommends using the same name for HELO and PTR. Its guidance for email service providers goes further and asks for the HELO, PTR and A record to use one hostname. ^{[2] [3]}

This is not a new idea. The SMTP standard, RFC 5321, says the name a client gives in EHLO must be a primary host name that resolves to an address record, or an address literal if the host has no name. ^[6] Gmail requires the sending IP to have a PTR whose hostname resolves back to that same IP. ^[4] Yahoo also requires valid forward and reverse DNS for sending IPs. ^[5] What is new is that Spamhaus now states these checks in one place and has given a timeline for enforcing them.

What can happen if the records don’t match

Spamhaus says it treats mail from IPs without reverse DNS as suspicious. That affects the IP’s reputation, and receiving systems that use Spamhaus data may filter the mail more heavily. ^[2] Its guidelines also say that failing these DNS and mail-server basics can lead to listings on its CSS (email spam IPs) or XBL (compromised IPs) zones. ^[2]

The guidelines list specific patterns to avoid. These include HELO values such as localhost, generic hosting-provider hostnames, HELO names that change between connections and hostnames that point to machines that do not send mail. For dedicated IPs, Spamhaus advises against keeping the provider’s auto-generated PTR, such as a name built from the IP address. It recommends a recognizable hostname on your own domain. ^[2]

Some details have not been published. The announcement does not give an exact enforcement date in November, a per-IP schedule or listing thresholds. Spamhaus also says its checker cannot return results for every IP and may not show recent changes. ^[1] So plan to meet the requirement rather than waiting for a specific date.

Who needs to act

If you send through a shared IP pool at an email service provider, the provider operates those IPs. It normally manages their PTR and HELO settings. Spamhaus’s ESP guidance makes providers responsible for mail sent through their infrastructure. ^[3] You probably have no DNS change to make for those IPs, although you should still confirm that your own SPF, DKIM and DMARC records are correct.

Dedicated IPs need a closer look. If your provider has given you a dedicated IP, check whether its PTR still shows a generic provider name. Then ask whether the provider can set a branded hostname on your domain. Spamhaus encourages ESPs to brand the reverse DNS and HELO with the customer’s domain where possible. ^[3]

Self-managed sending needs the most attention. This includes your own MTA, a cloud server that sends application email, and an office server that relays invoices or alerts. Usually, the hosting or IP provider controls the PTR, while your mail software controls the HELO name. Systems such as a website contact form, CRM or helpdesk that send directly from a server are easy to miss, so include them in your inventory. If you send over IPv6, Spamhaus also requires the address to come from a /64 or larger allocation with valid reverse DNS. ^[2]

Changing a hostname? Warm it up

Adding a missing PTR is usually a low-risk fix. Changing your HELO hostname needs more care. Spamhaus says HELO domains without a sending history face additional filtering. It recommends treating a new IP or HELO hostname with no history as a new asset and warming it up. ^[2]

The guidelines do not say how long that extra filtering lasts or whether sending history belongs to a hostname or its domain. Independent coverage has raised the same question. ^[7] If your current HELO name already resolves correctly, the safest option is usually to make the PTR and A record match that name instead of creating a new one. If you must use a new hostname, increase volume gradually and start with your most engaged recipients. ^[2]

Correct DNS is necessary but not enough

Correct HELO, PTR and A records remove one easy reason for a receiver to distrust you. They do not prove that recipients asked for your mail, and they do not guarantee inbox placement. The same Spamhaus guidelines also require confirmed opt-in for subscribers and SPF, DKIM and DMARC, with DKIM aligned to the visible From domain. They also require a bounce rate below 5%, one-click unsubscribe for bulk commercial email and unsubscribe requests processed within two days. ^[2] Mailbox providers also apply their own filtering rules. ^{[4] [5]}