HELO / EHLO problems

The SMTP HELO/EHLO hostname is missing, invalid, or inconsistent with reverse DNS.

Reading time:: 5 min
Difficulty:: Intermediate
Estimated duration:: 5 min
Prerequisites:: None
Last updated:: 2026-07-15
Author:: empire

Problem summary

The SMTP HELO/EHLO hostname is missing, invalid, or inconsistent with reverse DNS.

Severity: High

Symptoms

Filters cite HELO/EHLO or reverse DNS mismatch
Outbound HELO uses an unrelated or IP-literal hostname

Possible causes

Misconfiguration
Incomplete rollout
DNS propagation delay

How to diagnose

Confirm the symptom in headers or reports
Inspect the relevant DNS records
Validate with a trusted checker

How to fix

Correct the DNS or signing configuration
Re-test and confirm alignment where required

How to verify

Re-check DNS
Send a test message
Confirm expected authentication results

Prevention

Document changes
Monitor reports after deployment

When to escalate

Production mail is failing authentication after a change window

HELO / EHLOThe SMTP greeting hostname senders present; mismatches with reverse DNS often trigger filtering.
PTR recordsPointer records used for reverse DNS lookups of IP addresses.

CNAME at zone apexA CNAME is placed at the zone apex where other record types are also required.
Inconsistent authoritative answersAuthoritative name servers for the same zone return conflicting data.
Incorrect MX targetMX points to the wrong host name or unreachable mail server.
Missing glue recordsDelegation references in-bailiwick name servers without required glue.
MX record missingNo MX record is published for a domain that should receive mail.
NXDOMAIN for expected nameA name that should exist returns NXDOMAIN from authoritative servers.
Reverse DNS mismatchPTR (reverse DNS) for a sending IP is missing or does not match the forward hostname used in mail.
Stale DNS cache after changeResolvers still serve prior answers after an authoritative change because TTL has not expired.
Wrong TTL for cutoverTTL values are too high for a planned cutover, prolonging mixed old/new answers.

digCLI DNS lookup utility for authoritative and recursive inspection of mail-related records.
nslookupInteractive DNS lookup utility commonly used for quick MX and TXT checks.
Google Admin Toolbox DigBrowser-based dig-style DNS lookup from Google’s Admin Toolbox.
Google Admin Toolbox CheckMXGoogle Admin Toolbox Check MX for inbound mail DNS sanity checks.

Workflows

Open step-by-step: Diagnose mail DNS failuresSeparate authoritative errors, cache staleness, and delegation problems.
Open step-by-step: Configure reverse DNSAlign PTR and HELO/EHLO for each sending IP before warmup or production volume.

HELO / EHLO problems

Problem summary

Symptoms

Possible causes

How to diagnose

How to fix

How to verify

Prevention

When to escalate

▼Related learning

▼Related problems

▼Recommended tools

Workflows

HELO / EHLO problems

Problem summary

Symptoms

Possible causes

How to diagnose

How to fix

How to verify

Prevention

When to escalate

▼Related learning

▼Related problems

▼Recommended tools

Workflows