Spamhaus, whose blocklists and reputation data protect roughly 4.5 billion user mailboxes, has published a single consolidated set of Sender Guidelines, and it comes with a deadline that every self-hosted mail administrator and ESP should treat as live right now: starting in November 2026, Spamhaus is gradually rolling out a requirement for every sending IP to have a valid HELO, a reverse DNS (PTR) record, and a matching A record.
The rollout will happen over several months, and Spamhaus has not published an end date or a list of phases, so senders should assume the requirement can apply to their IPs at any point.
One place for rules that already existed
Spamhaus is clear that most of this is not new. The organization says its guidance has always been available, but it was spread across FAQs, best practice blogs and support tickets, and that the guidelines are not new rules: they reflect RFCs, mailbox provider best practices, and what responsible senders already do. The real change is enforcement of basic DNS hygiene. According to Spamhaus, invalid HELO values, missing reverse DNS, and missing matching A records are among the most common reasons for an IP to be considered for listing. A poorly configured server, the guidelines note, can easily be mistaken for a compromised one or a spammer.
The five minimum requirements
The Sender Guidelines list five minimum requirements that all senders must meet to avoid being listed:
- Use confirmed opt-in for all subscribers. Every recipient should confirm their address by clicking a link in a confirmation email. Purchased, rented and harvested lists are called out as the most common source of spam trap hits.
- Publish forward-confirmed reverse DNS for every sending IP. The PTR record must point to a fully qualified domain name, and that hostname must resolve back to the same IP.
- Use a HELO or EHLO hostname that resolves to the sending IP and stays consistent across connections. Placeholder values and hostnames that vary between connections are treated as signals of misconfiguration or compromise.
- Meet the IPv6 minimum. Sending addresses must fall within a /64 or larger allocation with valid reverse DNS.
- Authenticate mail with SPF, DKIM and DMARC. Publish SPF and DMARC for every sending domain, sign every outbound message with DKIM, and align the DKIM signing domain with the visible From domain.
Failure to meet the infrastructure and DNS requirements can result in listings on the Email Spam IPs (CSS) or compromised IPs (XBL) zones, which many receiving networks use for filtering.
Why this matters beyond the blocklist
The HELO, PTR and A record trio is the first handshake layer of email trust. When the hostname a server announces, the A record for that hostname, and the PTR record for the IP all agree, receivers and reputation systems can confirm who is connecting. When they disagree, the connection looks like a residential proxy, malware, or a compromised machine, and that is exactly what CSS and XBL listings flag.
The connection to authentication is direct. SPF, DKIM and DMARC all live in DNS, and DMARC in particular only works if the DNS records that carry it are correct and reachable. Spamhaus explicitly lists SPF, DKIM and DMARC among its minimum requirements and states that authentication is one of the signals that shapes reputation, so gaps in authentication make a listing more likely when other signals are weak. A sender who gets DMARC right but leaves broken reverse DNS on a dedicated IP is still exposed.
Spamhaus has also published a HELO and DNS checker on the guidelines page, and offers a simple test: send an email to [email protected] to see the HELO value your server currently announces.
What to do about it
Check every sending IP for forward-confirmed reverse DNS, a consistent HELO that resolves to that IP, and a matching A record. Remember that PTR records are usually controlled by whoever owns the IP block, so fixes may require a request to your hosting provider. Then verify that SPF, DKIM and DMARC are published and aligned for every sending domain. If you would rather leave DNS hygiene, blocklist avoidance and authentication to a platform that handles them from the start, sign up for free to Excello Mail.