Spamhaus Starts Enforcing HELO and Reverse DNS Checks on Sending IPs
From November 2026, Spamhaus is gradually requiring every sending IP to have a valid HELO, a PTR record and a matching A record. Here is who is affected and the checks to run before your IP lands on CSS or XBL.
Spamhaus has turned years of scattered FAQ advice into one rulebook. Its new Spamhaus Sender Guidelines, published on 21 October 2026, list the minimum requirements every sender must meet to stay off its blocklists. The part with a deadline is DNS: starting in November 2026, Spamhaus is gradually rolling out a requirement for every sending IP to have a valid HELO, a reverse DNS (PTR) record and a matching A record.
Spamhaus data feeds into the filters of a large share of mailbox providers and corporate mail servers, so an IP that fails these checks does not just lose reputation with one blocklist. It can start collecting rejections everywhere that queries Spamhaus.
Key facts
- Announced: 21 October 2026, in the Spamhaus Sender Guidelines
- Enforcement: gradual rollout starting November 2026, over several months
- Requirement: a valid HELO, a PTR record and a matching A record for every sending IP
- Risk if you fail: listing in the Email Spam IPs (CSS) or compromised IPs (XBL) zones
What Spamhaus announced
The Sender Guidelines bring together requirements that were previously spread across Spamhaus FAQs and support answers. They cover infrastructure and DNS, permission and list hygiene, authentication, sending practices and reputation. Spamhaus also published a companion page for ESPs and large senders, on how to apply the same rules at scale, and a built-in checker that tests the HELO and DNS setup of an IP.
Most of the guidelines describe practices Spamhaus has expected for a long time. What is new is the enforcement of the DNS basics. In its own words, the minimum requirements are the ones "all senders must meet to avoid being listed".
The three DNS checks, explained
1. Forward-confirmed reverse DNS
Every sending IP must have a reverse DNS (PTR) entry that points to a fully qualified domain name. That hostname must in turn resolve back to the same sending IP through an A record, or an AAAA record for IPv6. Spamhaus states that an IP with missing or mismatched reverse DNS is treated as suspicious. Our guide to PTR and rDNS records walks through the setup and the tests.
2. A HELO that resolves and stays stable
The hostname your server announces in the HELO or EHLO command must resolve to the IP it is connecting from, and it must stay the same across connections from that IP. Spamhaus calls out placeholder values, hosting-provider defaults and hostnames that change between connections as signals of misconfiguration or compromise. If you have ever seen 550 Access Denied: Invalid HELO Name, this is the same problem, now enforced at the blocklist level.
3. No generic rDNS on dedicated IPs
Spamhaus asks senders not to use generic or auto-generated rDNS entries that point to the hosting provider on dedicated IPs. A PTR such as the default name your VPS host assigns tells receivers nothing about who is sending. For IPv6, the sending address must sit in an allocation of /64 or larger, because ranges without reverse DNS or smaller than /64 are often misused.
What it means for senders
What changes
DNS hygiene stops being a best practice and becomes a listing criterion. An IP that fails can be listed in CSS or XBL, which receivers commonly query through the combined ZEN list.
Who is affected
Anyone who controls their own sending IPs: self-hosted Postfix, Exim or PowerMTA servers, mail sent straight from a VPS or a cloud instance, and dedicated IPs at an ESP. Shared-IP customers of a reputable ESP are covered by the ESP, but ask how it handles the rollout.
When
The rollout starts in November 2026 and runs over several months. Spamhaus has not published a per-month schedule, so treat every IP as in scope now.
Action checklist
- List every sending IP you control, including backup MTAs, application servers that send password resets and old relays nobody remembers.
- Check the PTR record of each IP: it must exist and return a fully qualified hostname that belongs to you, not a generic name from your host.
- Check the forward record: that hostname must resolve back to the same IP.
- Align the HELO name with that hostname and keep it fixed. On Postfix this is set by
smtp_helo_name, which defaults tomyhostname; on Exim it is thehelo_dataoption of the smtp transport. - Run the Spamhaus DNS checker on the Sender Guidelines page. Spamhaus notes that results are not available for every IP and may not reflect recent changes.
- Check current listings with the Spamhaus IP and Domain Reputation Checker, and if an IP is already listed, follow our Spamhaus ZEN removal guide.
The rest of the guidelines
DNS is the enforced part, but the guidelines set expectations well beyond it. Among the points worth noting:
- Confirmed opt-in for all subscribers: if no confirmation is received, do not send to that address. See our double opt-in guide.
- Authentication: publish SPF and DMARC for every sending domain, sign every outbound message with DKIM and align the DKIM domain with the visible From domain.
- Unsubscribes must be actioned within 2 days and added to a suppression list.
- Bounces: keep the overall bounce rate below 5%.
- Spam traps: do not try to identify or suppress spam trap addresses.
- Warming: HELO domains with no sending history are subjected to additional filtering, so new infrastructure needs a gradual ramp.
The bounce threshold is the one most likely to catch senders with older lists. Verifying the list before a send, with a tool such as SMTPing, removes invalid addresses before they turn into hard bounces.
Sources
- Spamhaus Sender Guidelines (primary source)
- Spamhaus: One clear set of rules, the Spamhaus Sender Guidelines, 21 October 2026
- Spamhaus: ESP and Large Sender Guidelines