Blog

created on: 2026-10-03 00:13:10

How to Set Up PTR (Reverse DNS) for Postfix Email Servers

Public

If your server's emails are bouncing at Yahoo, AOL, or BT with an error like:

550 5.7.25 Forward-confirmed reverse DNS failed

...you're missing (or have mismatched) reverse DNS. This is a different, separate check from SPF, DKIM, and DMARC — all of which can be perfectly configured while this one thing still silently blocks delivery to a subset of providers. Here's what it actually is, where each piece lives, and how to diagnose and fix it properly rather than guessing.

What Forward-Confirmed Reverse DNS (FCrDNS) actually checks

When your server connects to a recipient's mail server, it introduces itself with a hostname (the SMTP EHLO/HELO command). Some receiving mail systems then perform two lookups to confirm that hostname is legitimate:

Reverse lookup (PTR): given your server's IP address, what hostname does it resolve to?
Forward lookup (A record): does that hostname resolve back to the same IP?

If both match, the server is considered legitimate. If either is missing or they don't match, strict providers (Yahoo, AOL, and BT among them) reject the message outright — often with no warning beforehand, since this isn't something you can test from your own inbox.

Three settings, three different jobs — don't confuse them

This is the single most common source of confusion when fixing this, and it was ours too. Postfix has multiple hostname-related settings that sound similar but do genuinely different jobs:

postconf myhostname       # The server's own identity — also affects what mail is treated as "local"
postconf smtp_helo_name   # What's actually announced during outbound SMTP — overrides myhostname if set
postconf myorigin         # Used to build the sender address on locally-generated mail (e.g. bounce notices)

The one that actually matters for FCrDNS is smtp_helo_name. If it's explicitly set, it overrides myhostname for every outbound connection — so checking myhostname alone can give you a false picture of what your server is actually announcing to the world.

myorigin is a different, unrelated setting — it only affects the sender address Postfix uses for mail it generates itself (like bounce/non-delivery notifications), often pointing at /etc/mailname:

cat /etc/mailname

A mismatch here won't cause FCrDNS failures, but it's worth getting right anyway — otherwise your own bounce notifications can display a different (possibly wrong, or non-existent) domain than your actual mail server identity, which gets confusing fast when you're trying to diagnose a real problem later.

Where each DNS record actually lives — this trips people up

This was the crux of the whole fix for us, and the part most guides gloss over:

The forward A record (hostname → IP) belongs in your domain's own DNS zone — wherever you manage DNS for that domain (Cloudflare, CrazyDomains, etc.).
The PTR record (IP → hostname) belongs to whoever owns the IP address block — almost always your hosting provider, not your domain registrar. You cannot set this yourself through your domain's DNS panel, no matter how hard you look for it there.

If your smtp_helo_name uses a subdomain specifically for mail (e.g. relay.yourserver.example.com), you need both pieces set correctly, pointing at each other, for FCrDNS to pass.

Diagnosing it properly — don't trust checker tools as ground truth

Third-party tools like dnschecker.org and ispropagated.com are useful for a rough read on global propagation, but we found them genuinely misleading during an active DNS change — different public resolvers around the world cache independently and update on their own schedules, so these tools can show "not resolving" for hours or days after a change is actually, correctly live.

The only way to know for certain is to bypass every cache and ask the actual source of truth directly. First, find out who's authoritative:

dig -x 188.65.32.95

Look at the AUTHORITY SECTION of the response — it names the real nameserver responsible for that IP's reverse zone:

32.65.188.in-addr.arpa. 6863 IN SOA ns1.hyve.com. hostmaster.hyve.com. ...

Then query that specific server directly, skipping every intermediate cache:

dig -x 188.65.32.95 @ns1.hyve.com

If this returns the correct PTR value, your hosting provider has done their job correctly — any remaining delay is genuinely just propagation to the wider internet's resolvers, and the fix is time, not further changes. If the authoritative server itself doesn't return the right answer, that's real evidence to take back to your host, rather than a vague "is it done yet" support ticket.

The same technique works for the forward A record — query your domain's own authoritative nameserver directly rather than relying on a public resolver that might be showing you stale cached data:

dig A relay.yourserver.example.com +short

Setting the forward A record

In your domain's DNS panel:

Host:  relay.yourserver        (or however your panel expects a subdomain entered — some auto-append the root domain, some don't; check what's actually saved, not just what you typed)
Type:  A
Value: <your server's IP>

Requesting the PTR record from your host

This has to go to your hosting provider, with specifics — a vague request tends to sit in a queue. Be precise:

Please could you set up a PTR (reverse DNS) record for <your IP> resolving to <your hostname>. This is our server's configured SMTP HELO identity, and we're seeing mail rejected by providers requiring forward-confirmed reverse DNS. [Attach an actual bounce message as evidence if you have one — it gets tickets actioned faster than a description alone.]

Testing once both pieces are confirmed live

Don't just check your own inbox — SPF/DKIM were already passing for us before this fix, so test deliveries that specifically exercise FCrDNS-strict providers (Yahoo and AOL share infrastructure, so one address covers both):

echo "Test email" | mail -s "Test" -r you@yourdomain.com someone@yahoo.co.uk

Ask the recipient to confirm receipt (check spam too) — and if it bounces, get the full bounce text, not just "it didn't arrive." The exact rejection reason tells you immediately whether you're dealing with the same issue still propagating, or a genuinely different problem (e.g. IP reputation, which can lag behind a DNS fix even once the DNS itself is correct).

Quick summary checklist

Check	Command
What hostname does outbound mail actually announce?	`postconf smtp_helo_name`
Does that hostname have a forward A record?	`dig A <hostname> +short`
Does the IP have a matching PTR record?	`dig -x <ip> +short`
Who's actually authoritative, bypassing caches?	`dig -x <ip>` → check `AUTHORITY SECTION`
Query the authority directly for certainty	`dig -x <ip> @<authoritative nameserver>`
Real-world test against a strict provider	`mail -s "Test" -r you@domain.com someone@yahoo.co.uk`

Written up from a real diagnosis on a client project — including the propagation-checker false alarms, the article that nearly sent us down the wrong path by conflating myhostname with smtp_helo_name, and the fix that actually worked.

Poetic Notes:
Ethical Notes:
This caption is purely reflective — an imaginative note about perception."

The Parable of Fido’s Pack

(2026-08-13 14:42:25)

I. The Ridge and the Pears

The peak sat high in a crown of white,

His teacher had warned him: "Travel light.

Fill not your pack with the heavy and vain,

For a burdened back is a journey in pain."

Near the rocky ridge, sweet pears hung low,

Enough to fuel where he needed to go.

He reached for the branch, then paused his hand,

And widened his gaze to perceive the land.

“If I carry them all, I am bound to the ground,

My eyes will grow narrow, my steps unbound.

I’ll miss the trap, or I’ll miss the way—

And the squirrels need fruit for a colder day.”

He watched a bee on a blossom dance,

And left the pears to the wild and chance:

“Let the bees work on, let the sweet fruit grow,

In case I descend to the vale below.”

II. The Nectar, The Thistle, and The Trap

A purple thistle stood sharp and high,

As a busy worker went buzzing by.

“The bee seeks nectar, the fly seeks decay,

Yet both can be trapped on the winding way.

Does the bee see the spider web spun in the trees?

Does the Venus flytrap distinguish the bees?”

His mind drifted back to a woman of old,

In a provocative dress, with a voice turned cold—

Who called him perverse for the spark in his eye,

When she’d laid out the nectar as he walked by.

“If you show the nectar,” he thought with a grin,

“The natural response isn't error or sin.

You are but a thistle, sharp-edged and wild.”

And lost in his thought, he walked on like a child.

He stepped past a dead squirrel, dried in the sun,

(A meal for the ridge when the climbing was done)—

He missed it entirely, his mind in a fog,

Fixated on thistles beside a wet log.

III. The Stream and the Breadcrumbs of Slate

“What use is a thistle?” he pondered aloud,

As a dark shadow drifted across a gray cloud.

“Where the nettle stings, the dock leaf grows near;

Perhaps this sharp plant is a cure for my fear.

A remedy held for a bite or a sting—

I shouldn't abandon so useful a thing.”

He looked to the valley, the memory gone—

He’d forgotten the path where the pear tree had shone.

So he knelt by the water, cool, quiet, and deep,

And gathered forty flat stones from the sleep.

He laid down a trail, a light grey ribbon of slate,

Leading back to the thistle, to anchor his fate.

“If I need the plant’s medicine, the path will be clear;

If I hunger, the stones guide me back to the pear.”

IV. The Wasp, The Wolf, and The Trap

As he walked tiredly up the crumbling slopes,

He heard a soft buzz and in his mind took notes.

He looked across close and saw a sharp wasp:

“If I get stung now, I'll be utterly lost!”

His gaze grew too narrow, fixed tight on the threat,

And he missed where a hive of sweet honey was set.

Quietly nesting near roots of the trees,

He stepped on the ground and panicked the bees.

Yet he remembered the verse, and checked his broad stride:

“A stance built too wide will be stumbled by pride.”

Eyes half on the wasp floating near to his hair,

He searched through the leaves for a path to a pear.

Then a low, hollow growl echoed out through the sky—

A hungry wild wolf, with famine in its eye.

Blind to the forest, like a sheep in a pen,

Ignorance makes prey of the strongest of men.

Like a chicken that steps in a cage for the grain,

Or a lamb lured away to be bound in a chain,

The beast moved to strike, but Fido took flight,

Following the pebbles laid out in the light.

V. The Remedy and The Sovereign Win

Down the slate trail he ran, quick as a whistle,

All the way back to the lonely old thistle.

He collapsed by the plant, feeling sharp pain and heat,

From a bee sting now swelling right over his knee.

Beside him he noticed the squirrel lying dead,

And remembered the words that his master had said:

“What the enemy fears shows the edge of his blade—

Let him fall on your stance, or the price will be paid.”

He crushed up the thistle—both poison and cure—

And pressed it right onto the sting to make sure.

Then he looked at the wolf who came skidding to stop,

Standing hungry and fierce at the edge of the drop.

Fido smiled softly, his heart standing still,

No longer the prey on a crumbling hill.

He offered the squirrel as a peaceful reward,

Or laced it with thistle to shatter a sword.

A threat turned to ally, a sting turned to grace,

A lesson extracted in this quiet place.

No weight in his backpack, no anger within—

A sovereign resolution: a win-win-win.

VI. The Campfire and The Companion

The shadows grew long as the autumn wind blew,

And the cold evening mist settled over the dew.

Fido struck a small spark by the edge of the stone,

No longer afraid, and no longer alone.

The wolf sat beside him, eyes quiet and clear,

The hunger now gone, and replaced by no fear.

No cage to contain him, no chain on his neck,

Just two living souls who had honoured respect.

Fido looked at the ridge rising high in the night,

And knew that the peak wasn't won in a fight.

The summit is reached not by reaching the top,

But knowing exactly where striving can stop.

He’d learned when to travel, and how to pack light,

How to keep his gaze wide, and his heart out of fight.

He’d found the true gap where the storm passes through,

And turned what was hostile to something born new.

With the morning’s first light, down the trail they both ran,

The wolf at the side of a sovereign man.

Back home to the flat, to the work and the grace,

With a light, empty pack and a smile on his face. 💛🌀🌙