Forward-confirmed reverse DNS means that a sending IP resolves through PTR to a hostname and that hostname resolves back to the sending IP. Mail receivers can use this as one signal when evaluating a server. It is separate from SPF, DKIM and DMARC.
IN THIS ARTICLE
What you need before you begin
Identify the public IP that actually sends the mail, including any relay or NAT arrangement. Reverse DNS is normally controlled by the IP allocation provider, not by whoever hosts your ordinary forward DNS zone. Record the mail server's current identity before changing it.
01 Check forward-confirmed reverse DNS for a mail server address
- Query the actual sending IP for PTR and record the returned hostname. If a third-party mail provider sends the message, consult that provider rather than changing unrelated website DNS.
- Query A and/or AAAA for the PTR hostname. Confirm the relevant answer contains the original sending address.
- If you administer the mail server, choose an appropriate fully qualified hostname and configure its forward address first. Coordinate mail-server identity and certificate requirements with the platform's supported process.
- Set the PTR through the VPS/dedicated-IP provider's reverse-DNS control or support workflow. Adding a PTR under an ordinary example.com forward zone does not update the IP's reverse zone.
- Retest both directions, then send a controlled message and inspect headers and recipient diagnostics. Check IPv6 reverse DNS when the server can send over IPv6.
02 Read-only diagnostic example
dig -x 192.0.2.10 +short
dig mail.example.com A +short
dig mail.example.com AAAA +short
Replace example names and documentation addresses with the exact authorised service details. These commands query existing configuration; they do not change DNS.
Confirm the expected result
The IP-to-name and name-to-IP path should agree for each active sending address. Confirm the server sends from the expected address and that other authentication and delivery checks still pass.
Troubleshoot unexpected results
If the provider controls a shared sending IP, you may not be able to choose its PTR independently. Use the supported relay identity and escalate a reverse-DNS failure with the actual sending IP and rejection message.
A common question
Does correct PTR guarantee that messages will reach the inbox?
No. It is one infrastructure check. Reputation, authentication alignment, content, recipient policy and sending behaviour also matter. Repair the specific diagnostic instead of treating a PTR change as a universal delivery fix.