Where you saw it: A mail tester reporting no reverse DNS, a bounce refusing the connection, or consistently poor placement from a new sending IP.
Why it happens
- The IP was never configured with a PTR record, which is the default state for most cloud instances.
- Cloud providers often require a support request or an explicit setting to add one.
- The record was removed during an infrastructure change and nobody noticed.
- The IP sits behind NAT and the outbound address is not the one you configured.
The fix, in order
Confirm there really is nothing
Run dig +short -x your.sending.ip. Empty output means no PTR record exists for that address.
Find out which IP you actually send from
Behind NAT or a proxy the outbound address may differ from the server's own. Check your mail logs or the Received headers of a message you sent.
Ask the IP owner to create it
Your hosting provider, cloud vendor or mail service controls the reverse zone. Most have a control panel setting, and some need a ticket.
Publish the matching forward record
Create an A record for the hostname pointing back at the same IP, so the forward-confirmed check succeeds in both directions.
Align HELO with the new name
Configure your mail server to announce the same hostname at HELO that the PTR record returns.
How to know it worked
The short version
- dig +short -x IP returns your chosen hostname.
- dig +short A on that hostname returns the same IP.
- A mail tester passes the reverse DNS check.
- Delivery improves at receivers that were filtering you heavily.
Questions people ask
Can I send mail without a PTR record?
Some receivers will accept it, and several large ones will not. For any serious sending it is a requirement rather than an optimization.
What hostname should the PTR record use?
Something under your own domain that identifies the mail server, such as mail.yourdomain.com, with a matching A record. Generic provider hostnames carry much less weight.
Why does this affect email verification?
The same rule applies to our probe connections. Receivers that reject connections without valid reverse DNS reject probes for the same reason, which costs coverage rather than accuracy.