Study: 28% of 494 Domains Sent Some Mail From IPs Failing Spamhaus DNS Checks
Summary
An SH Consulting analysis of 30 days of DMARC data found 99.74% of 11,846 legitimate sending IPs passed reverse-DNS checks, but 137 of 494 domains used at least one failing IP. HELO was not assessed.
Key points
- Spamhaus plans to gradually enforce requirements for sending IPs to have a valid HELO name, PTR record and forward-confirmed DNS; noncompliant IPs may be listed.
- The study examined 11,846 publicly routed IPs and 13.97 million messages across 494 domains, counting mail that passed DMARC-aligned DKIM or SPF.
- 31 legitimate sending IPs (0.26%) failed forward-confirmed reverse DNS, accounting for 3,262 messages; 20 had no PTR record and 11 did not resolve back to the sending IP.
- Although 137 domains had some legitimate mail from a failing IP, the study found that this was usually a small share of their mail.
- 15 failing IPs belonged to Microsoft; 13 still had no PTR record during the October 27 checks. Microsoft 365 customers cannot set PTR records for Microsoft-owned IPs themselves.
- Among IPs sending mail that failed both SPF and DKIM, 81% failed forward-confirmed reverse DNS and more than half had no PTR record.
- DMARC reports do not include HELO, so the study could not assess that requirement; the article provides steps for checking PTR, forward DNS and HELO.
Article Details
- Publisher
- SH Consulting
- Report Period
- 30-day DMARC reporting period in September–October 2026; follow-up DNS checks on 2026-10-27
- Scope
- DMARC-aligned mail sent for monitored client domains; analysis of sending-IP PTR and forward-confirmed reverse DNS records. HELO compliance was not measured.
- Sample Size
- 494 client domains; 11,846 publicly routed sending IPs (9,016 IPv4 and 2,830 IPv6); 13.97 million messages.
- Key Statistics
- 31 of 11,846 legitimate sending IPs (0.26%) failed forward-confirmed reverse DNS; they sent 3,262 messages, or 0.023% of legitimate volume.
- 137 of 494 domains (28%) sent at least some legitimate mail from a failing IP.
- Of 18,619 IPs sending mail that failed both SPF and DKIM, 81% failed forward-confirmed reverse DNS.
- 15 failing IPs belonged to Microsoft; they carried 76% of failing legitimate mail and were associated with 123 of the 137 affected client domains.
- On 2026-10-27, 13 Microsoft IPs still had no PTR record; Microsoft's authoritative servers returned “non-existent domain” for each.
- Recommendations
- Inventory every system that sends mail as your domain, including website forms, CRMs, billing tools, servers, and office devices.
- For systems outside large providers, check each sending IP's PTR record and confirm that the resulting hostname resolves back to the same IP.
- Check that each server's HELO name matches its PTR hostname and that both resolve to the sending IP.
- Run sending IPs through Spamhaus's DNS checker and Reputation Checker; for dedicated IPs with branded reverse DNS, verify that the corresponding A record still exists.
Vendors
MicrosoftBut 137 of the 494 domains (28%) sent at least some mail from a failing IP, almost all of it through Microsoft 365, and for most it was a small share of their mail. Among the IPs sending spoofed mail as the sameSpamhausSpamhaus’ New Sender Rules: We Tested 494 Client Domains Before They Go Live
Products
Microsoft 365 Apps for EnterpriseBut 137 of the 494 domains (28%) sent at least some mail from a failing IP, almost all of it through Microsoft 365, and for most it was a small share of their mail. Among the IPs sending spoofed mail as the sameSpamhaus ZENIPs that fail can be listed on the Combined Spam Sources (CSS) or Exploits (XBL) lists. Both are part of Spamhaus ZEN, which many receiving mail servers check on every incoming connection.