Spamhaus Sender Guidelines state that starting in November 2026 they gradually roll out requirements for every sending IP to have a valid HELO, a reverse DNS (PTR) record, and a matching A record. Forward-confirmed reverse DNS means the PTR hostname must resolve back to the same IP. This runbook prepares operators; live lookups belong in Spamhaus’s own checker.
- Inventory sending IPs. List every egress IPv4/IPv6 used for SMTP, including ESP-allocated ranges you control branding for.
- Self-report on this checklist. Mark PTR quality, HELO quality, IPv6, and role. Copy the remediation checklist into your change ticket.
- Fix PTR with your upstream. Request branded FQDN PTR; publish matching A/AAAA for FCrDNS.
- Align HELO/EHLO. Configure the MTA so HELO is a hostname resolving to the connecting IP and does not rotate per connection.
- Avoid generic hosting PTR strings on dedicated sending IPs — guidelines call these out as negative signals.
- If on IPv6, follow allocation and reverse DNS minimums in the live Sender Guidelines (commonly discussed as /64-scale guidance).
- Verify with Spamhaus HELO/DNS checker for each IP after DNS TTLs settle. This site never queries DNS for you.
- Re-read live Spamhaus Sender Guidelines the week you freeze changes — rollout is described as gradual over months.
Authentication (SPF/DKIM/DMARC) and confirmed opt-in remain separate minimums in the same guidelines.