Deliverability fundamentals

Reverse DNS (PTR) for mail servers

Before a receiving mail server looks at your SPF, DKIM or DMARC, it checks one thing: does your sending IP have a reverse DNS record? Here is what that means and how to get it right.

Check your PTR record in seconds

The free InboxProof reverse DNS checker looks up your IP's PTR record, resolves it back, and tells you if it forward-confirms. No signup.

Run the free check

What is a PTR record?

Every IP address can have a reverse DNS record, called a PTR (pointer) record. It maps an IP address back to a hostname. Forward DNS answers "what IP does this name point to"; reverse DNS answers "what name does this IP belong to".

When your mail server sends an email, the receiving server looks up the PTR for your sending IP. If the lookup fails, or the hostname does not look like a real mail host, the receiver treats the connection as suspicious.

Why receiving servers require it

Reverse DNS is one of the earliest trust signals a mail server checks. Gmail, Microsoft 365 and most other large providers expect a valid PTR for the IP that connects to them on port 25. A missing PTR is a common, silent reason mail gets down-ranked or rejected before your authentication records are even evaluated.

It is also the first line of defense against spoofing: if an IP has no PTR, it is harder for a receiver to verify that the sender is who they claim to be.

What is forward-confirmed PTR?

A PTR record alone is not enough. Most providers require forward-confirmed PTR (FCPTR): the hostname in the PTR record must resolve back to the same IP address.

In other words, the round trip must hold:

IP 203.0.113.10 has a PTR pointing to mail.yourdomain.com
mail.yourdomain.com has an A record pointing back to 203.0.113.10

If either leg is broken, the PTR does not forward-confirm and the receiver may reject the connection.

How to check your PTR record

Run this command to look up the PTR for a sending IP:

dig +short -x 203.0.113.10

Replace 203.0.113.10 with your actual sending IP. If the command returns nothing, your IP has no PTR record.

Then confirm the hostname resolves back to the IP:

dig +short A mail.yourdomain.com

If the returned IP matches the original, your PTR forward-confirms.

The free InboxProof reverse DNS checker does both lookups for you and reports the result.

How to fix a missing or broken PTR

Managed mail (Gmail, Microsoft 365, etc.): PTR is set automatically by the provider. You usually do not need to do anything.
Your own mail server: ask your hosting provider or ISP to set the PTR for your IP. Most providers manage the reverse zone and will create it on request.
Cloud IP (AWS, GCP, Azure): use the provider's console to create a reverse DNS record for the IP (e.g. EC2 "Edit address" → DNS hostname).
Hostname mismatch: make sure the PTR hostname matches the hostname your mail server announces in its SMTP banner.

PTR vs SPF, DKIM and DMARC

These are different layers, and all of them matter:

PTR / reverse DNS: proves the IP belongs to a real host. Checked first, before authentication.
SPF: lists which IPs are allowed to send for your domain.
DKIM: cryptographically signs the message so it cannot be altered in transit.
DMARC: tells receivers what to do when SPF or DKIM fail.

A missing PTR can sink mail even when SPF, DKIM and DMARC are all correct. Check it early.

Check your sending IP's PTR

Run the free reverse DNS checker and see if your PTR record forward-confirms.

Run the free check

Want this checked automatically every day? Inboxproof Pro monitors your domain around the clock and alerts you the moment a record breaks or an IP gets listed. See pricing →