Knowledge baseNetwork

Setting up reverse DNS: why your mail server needs a PTR record

16 October 20264 min read

An ordinary DNS record translates a name into an IP address. Reverse DNS does the opposite: a PTR record says which name belongs to an address. For most services you notice nothing when that record is missing. For mail you do, and that is where it usually goes wrong for anyone putting their own mail server on a new address, for example with IP transit or in a rack with us.

Why mail breaks on it

Receiving mail servers use reverse DNS as a cheap first filter against spam. They look at the address the connection comes from and ask three questions:

  • Is there a PTR record? — without one, many servers refuse the mail outright or give it a hefty spam score.
  • Does the name point back to the same address? — the PTR record for 192.0.2.25 names mail.example.com, and mail.example.com must point back to 192.0.2.25. That is called forward-confirmed reverse DNS.
  • Does the name match the server? — the name your mail server announces itself with (the HELO name) should be the same.

A generic name like "host-192-0-2-25.provider.net" passes the first question but falls through on the other two. Outside mail a good record helps too: in a traceroute, in log files and with an abuse report you see straight away which server it is about.

Not at your DNS provider

The misconception is that you set the PTR record where you manage your other DNS records. That is not possible: reverse DNS lives in a separate zone that belongs to the address space, not to your domain name. Whoever hands out the IP addresses manages that zone. For addresses from us that is us, which is why you set it with us.

How to set it

Under Network → Routing → IP addresses you find your addresses with their description and, in the Reverse DNS column, the name currently attached. If you have set nothing, a default name of ours is shown.

Network → Routing → IP addresses: per address the reverse DNS currently in effect.

Click an address and fill in the hostname that belongs to it. If the address is not listed yet, add it with Add IP address, within one of your own prefixes, with a description so your colleagues know later what it is for.

Editing an address: the hostname becomes the PTR record.

Then do not forget the other side. The A record (or AAAA for IPv6) for the same name goes in at your own DNS provider, and the HELO name is set on your mail server. Only when all three match is the check complete.

You decide who may change this: reverse DNS falls under the Manage network right. How to give colleagues that access is covered in Giving colleagues access.

Where you see no field

For some addresses the column shows only a dash and there is no field to fill in. Then the reverse zone is not with us, for example for your own address space delegated to other name servers. We check every hour which zones point to our name servers. Showing a field for a zone we do not manage would be a promise we cannot keep; there you set it with the party hosting the zone.

IP addresses at Xyphen IT

Reverse DNS comes with every IP address you get from us, whether through IP transit or with colocation. Is your mail getting stuck on a PTR check, or do you want to bring your own address space to us? Get in touch.

Frequently asked questions

Frequently asked questions

Can I set the PTR record at my domain registrar?

No. The PTR record lives in the reverse zone of the IP address, and that belongs to whoever manages the address space, not to whoever manages your domain name. For addresses from us you set it in our dashboard.

What is there if I set nothing?

A default name of ours. That is better than no record, but a mail server that checks whether the name points back to the same address and matches the name your server announces itself with will not be satisfied by it.

Why can I not fill in reverse DNS for some addresses?

Because the reverse zone of that address is not with us, for example for your own address space delegated to other name servers. A name in our dashboard would do nothing there, so we do not show the field. You set it with the party hosting that zone.

Answer not found?

Ask an engineer directly — we usually respond within one business day.