Spamhaus published its Sender Guidelines in October 2026, and the one rule with a start date is about your mail server's name. Starting in November 2026, Spamhaus is gradually requiring every sending IP to have a valid HELO name, a reverse DNS (PTR) record and a matching A record. A server that fails it risks a listing on the CSS or XBL zones.
Most of the guidelines restate practice that deliverability people already follow. The HELO and reverse DNS rule is different, because it turns a common default on cheap servers into a listing reason.
What did Spamhaus publish in October 2026?
Spamhaus published two documents: the general Sender Guidelines and a separate page for ESPs and large senders. The Spamhaus pages carry no publication date. The earliest dated writeup is Steve at Word to the Wise on October 22, 2026, and Al Iverson covered them at Spam Resource on October 28, 2026.
The general page opens with five minimum requirements that every sender must meet to avoid being listed:
- Confirmed opt-in for every subscriber.
- Forward-confirmed reverse DNS for every sending IP.
- A HELO hostname that resolves to the sending IP, consistent across connections.
- IPv6 sending space of a /64 or larger, with valid reverse DNS.
- SPF, DKIM and DMARC on every sending domain, with DKIM aligned to the visible From domain.
The ESP page adds that everything in the general guidelines applies to mail sent through a platform, and that a provider is responsible for the mail its customers send.
What does the Spamhaus HELO and reverse DNS rule check?
The Spamhaus rule checks three DNS facts about the IP that connects to a receiving server, and all three have to agree.
| Check | What has to be true | Required or recommended |
|---|---|---|
| HELO name | The name your server announces in EHLO resolves to the sending IP | Required |
| HELO consistency | The same HELO name is used on every connection from that IP | Required |
| Reverse DNS (FCrDNS) | The IP has a PTR record pointing to a hostname, and that hostname resolves by A or AAAA back to the same IP | Required |
| HELO matches PTR | The HELO name and the PTR hostname are the same name | Recommended |
| Branded names | The PTR and HELO use your own domain rather than the host's default | Recommended |
Forward-confirmed reverse DNS, or FCrDNS, is the round trip in the third row: IP to name through PTR, then name back to IP through A. One direction alone proves nothing, because the IP owner publishes the PTR and the domain owner publishes the A record, so only agreement shows one operator holds both.
Spamhaus also lists what it treats as misconfiguration or compromise. That list includes placeholder HELO names such as localhost, hosting-provider or ISP default hostnames, HELO names that resolve to infrastructure that does not send, and HELO names that impersonate Gmail or Hotmail. Several HELO names from one IP resolving to different addresses can point to residential proxy or malware behavior, according to Spamhaus.
When does the HELO requirement take effect?
Spamhaus says only that it is "gradually rolling out" the requirement starting in November 2026. It publishes no end date, no phases and no schedule by network, so nobody outside Spamhaus can tell you which IPs are already being judged on it.
The practical reading is to treat the rule as live from November 2026. A server that passes costs nothing to keep passing, while a server that fails has no announced grace period to rely on.
Which senders will the HELO and reverse DNS rule catch?
The Spamhaus rule mostly catches senders who run their own mail server on default settings. That is an inference from the failure patterns Spamhaus names, not a list Spamhaus publishes, but the patterns point at the same few setups:
- Self-hosted servers on a VPS. A fresh virtual server often arrives with a PTR such as a provider's generic hostname and a mail server announcing the machine's local name. Spamhaus names generic, auto-generated reverse DNS as something to avoid and placeholder HELO names as a red flag.
- Cold-email setups on new IPs and new domains. These combine a default server name with no sending history, and Spamhaus treats any change of IP or HELO as a new asset that needs warming.
- Small ESPs and in-house platforms. A shared pool where each IP announces a different name, or where the PTR was never set, fails the consistency check on every connection.
If you send through an established ESP's shared IPs, the HELO and PTR belong to the provider, not to you. The Spamhaus ESP page asks those providers to make the HELO, PTR and A record use the same hostname, ideally branded with the customer's domain.
How do you check your own HELO and reverse DNS?
You can test the Spamhaus HELO and reverse DNS rule in four steps with free tools and one terminal.
- Find the sending IP. Send a message to an address you control and open the headers. Paste them into the Unspam email header analyzer, which lists every delivery hop by sending and receiving host. On the hop where your server handed the message to the recipient's server, the sending host is usually the HELO name your server announced; some servers, such as Exim, print the reverse DNS name there and put the HELO in a
helo=note instead. The connecting IP is in the fullReceived:line of that hop, usually in square brackets. - Check FCrDNS on that IP. Put the IP into the Unspam IP blacklist checker. Alongside the blocklist results it reports forward-confirmed reverse DNS on your sending IP, and it accepts any PTR name that confirms, not only the first.
- Resolve the HELO name. Run the two lookups below and confirm the HELO name returns the sending IP.
- Ask Spamhaus. The guidelines page has its own DNS checker, and Spamhaus also offers an automated check by sending a message to
helocheck@abuseat.org.
dig -x 203.0.113.25 +short
dig mail.example.com A +short
The first command returns the PTR hostname for the IP. The second should return 203.0.113.25 when mail.example.com is your HELO name. If you control the server, set its HELO to that same confirmed hostname, which satisfies the requirement and the recommendation at once. Our guide to reverse DNS walks through adding the PTR record when your host has not set one.
What other numbers do the Spamhaus Sender Guidelines put in writing?
Spamhaus attaches a number to eleven other practices, and each one below comes from the two Spamhaus pages as published in October 2026.
| Practice | Spamhaus figure | Page |
|---|---|---|
| Overall bounce rate | Below 5% (required) | Sender Guidelines |
| Repeated soft bounces | Investigate after 3 to 5 consecutive | Sender Guidelines |
| Unsubscribe requests | Actioned within 2 days | Sender Guidelines |
| DKIM key length | 1024-bit minimum, 2048-bit recommended | Sender Guidelines |
| DKIM key rotation | At least annually | Sender Guidelines |
| SPF lookups | Within the 10 DNS lookup limit, nested includes counted | Sender Guidelines |
| Newly registered domains | On the Zero Reputation Domains list for 24 hours; not used for mail for at least 30 days | Sender Guidelines |
| Warm-up | Start slowly for any IP or domain that has not sent in the past 90 days | Sender Guidelines |
| Inactive mailboxes | Can be repurposed as spamtraps after more than 12 months | Sender Guidelines |
| IPv6 allocation | At least a /64, with reverse DNS | Sender Guidelines |
| Per-customer monitoring | Act on bounce rates above 5% and complaint rates above 0.3% | ESP and large senders |
Two of these are easy to check from a browser. The Unspam SPF checker walks the include tree and counts lookups against the limit of 10, and the Unspam DKIM checker reports the RSA key size of each selector it finds, so a 1024-bit key shows up as one to upgrade to 2048.
The last row is advice to providers about monitoring their customers, not a rule for an individual sender. It is the one place the guidelines name a complaint rate.
How does the HELO rule relate to a Spamhaus listing?
Failing the Spamhaus HELO and reverse DNS rule can get an IP listed on the CSS or XBL zones, which Spamhaus names as the consequence and which sit inside ZEN, the zone most mail servers query. CSS is the automatic list of IPs sending spam, and XBL is the list of machines that look compromised. A placeholder HELO looks like both.
That matters for removal. An XBL entry for a server that still announces localhost will come back after removal, because the listing is generated by what the server does. Fix the HELO and the PTR first, then follow the route in our guide to Spamhaus delisting, which covers which lists you can remove yourself and which need evidence.
Spamhaus also states that it does not accept requests to explain reputation attributes or to reset reputation. A clean configuration is the only lever a sender has.
What do the Spamhaus guidelines leave open?
The Spamhaus Sender Guidelines leave three things open. There is no date by which the HELO rollout finishes, no statement of how fast a failing IP is listed once it is in scope, and no published dates on the pages themselves, so a later edit will not be visible as one.
Everything else in the guidelines is stable practice: confirmed opt-in, aligned authentication, clean DNS and gradual warm-up. For most senders the HELO name is the piece most likely to have been left on its default, and it is the one with a rollout already under way.
