Spamhaus Sender Guidelines
Requirements and recommendations to help email senders follow best practices and strengthen trust and safety on the internet.Starting in November 2026, we are gradually rolling out a requirement for every sending IP to have a valid HELO, a reverse DNS (PTR) record, and a matching A record. Use the HELO checker below to see whether the DNS meets our best practices, and follow the guidelines to avoid being listed.
Minimum requirements
Guidance for senders, mail admins, and postmasters on meeting Spamhaus's sending requirements. All senders must meet these minimum email sending requirements to avoid being listed.
Use confirmed opt-in (COI) for all subscribers
Each recipient should confirm their address by clicking a link in a confirmation email. If no confirmation is received, do not send email to that address. Purchased, rented and harvested lists are the most common source of spam trap hits, and hitting traps is one of the fastest routes to a listing. See section
Publish forward-confirmed reverse DNS for every sending IP
Every sending IP must have a reverse DNS entry pointing to a fully qualified domain name (FQDN). That hostname must, in turn, resolve back to the same sending IP address. This is known as forward-confirmed reverse DNS (FCrDNS). An IP with missing or mismatched reverse DNS is treated as suspicious and is one of the most common reasons for an IP to be considered for listing. See section
Use a HELO/EHLO hostname that resolves to the sending IP
The hostname the server announces in the HELO/EHLO command must resolve to the IP it is connecting from, and must stay consistent across connections from that IP. Placeholder values, hosting-provider defaults, and hostnames that vary between connections are treated as signals of misconfiguration or compromise and can result in a listing. See section
Meet the IPv6 allocation and reverse DNS minimum
If sending over IPv6, the sending address must fall within an allocation of /64 or larger (a /64 is the standard block size we recommend assigning), and that space must have valid reverse DNS. IPv6 ranges without reverse DNS or with allocations smaller than /64 are often misused by spammers. See section
Authenticate mail with SPF, DKIM and DMARC
Publish SPF and DMARC records for every sending domain, sign every outbound message with a signature, and align the DKIM sending domain with the domain in the message's RFC 5322 From address. Authentication is one of the signals that shapes reputation, so gaps here make a listing more likely when other signals are weak. See section
1. Infrastructure and DNS
All sending infrastructure must have the following DNS and mailserver configuration. Failure to do so can result in IPs being listed on the Email Spam IPs (CSS) or compromised IPs (XBL) zones.
Do
Ensure the sending IP address has a valid reverse DNS (rDNS) entry resolving to a fully qualified domain name (FQDN) for the sending IP address. Spamhaus will treat emails originating from IP addresses without rDNS as suspicious and this will be reflected in the IP's reputation, and receivers using Spamhaus data may subject it to additional filtering.
Ensure the rDNS hostname resolves to the connecting IP address via a corresponding forward DNS (A/AAAA) record.
Abusive actors often rely on the reputation of upstream DNS records to hide their identity. Instead, configure a branded reverse DNS to use the sender's own domain, to improve trust signals for the IP address.
Don't
Do not use generic or auto-generated rDNS entries for dedicated IPs that point to the hosting provider (e.g.,
static-203-0-113-25.hosting.example.net,203.113.0.25.broadband.example.net,vps-25.dedicated.hosting.example.cometc). These can negatively impact reputation.Do not use random dictionary words in the rDNS and make it identifiable to the sending infrastructure.
How to check
Use the Spamhaus DNS checker tool to check your rDNS configuration.
Do
Ensure the hostname used in the HELO/EHLO command resolves to the sending IP address.
Maintain a consistent HELO value that resolves to the sending IP address. Multiple HELO values resolving to different IP addresses may indicate residential proxy and/or malware behaviour.
Where possible, ensure the HELO/EHLO hostname is consistent with the rDNS hostname.
Host a webpage on the domain of the HELO, that explains what the domain is for, or that redirects to the main brand domain.
Don't
Do not use placeholder values such as
localhostor generic hostnames that point to the hosting company/ISP as the HELO value.Do not resolve HELO hostname to infrastructure that is not used for sending — this behaviour is associated with spoofing and misconfiguration.
Do not use generic or auto-generated names provided by the hosting provider, use the sender's own domain where possible.
Do not impersonate the HELO value of well-known mailbox providers like Gmail or Hotmail.
How to check
Enter an IP address into the Spamhaus DNS Checker at the top of this page, to check its HELO value. An email can also be sent to helocheck@abuseat.org to check the HELO being used.
Do
IPv6 customer allocations must be at least /64 and must have valid reverse DNS. The /64 minimum is consistent with IPv6 subnet architecture and RFC 6177's guidance that email senders should be able to obtain at least a /64. This is further discussed in M3AAWG best practices for IPv6 allocation.
Add routes for all IP space owned by the sender to reduce vulnerability to BGP hijacking, which can allow hackers to send email that appears to originate from the IP space.
How to check
Run dig -x <an IPv6 address in the allocation> to confirm reverse DNS is present. To confirm the space is actually routed, look the address up at bgp.he.net.
Do
Don't
Do not allow freemail addresses such as
gmail.comorhotmail.comas the 'Envelope FROM.'Do not use the NULL envelope sender
<>for anything other than indirect out-of-band delivery reports, DSNs and MDNs.Do not send bounce messages after accepting unwanted mail. Reject it during the SMTP transaction instead. Bounces sent to forged senders are known as backscatter, which is indirect spam and can severely harm reputation.
How to check
Run dig TXT <envelope sender domain> and confirm an SPF record is returned and includes the sending IPs.
Do
Audit DNS regularly and remove records for services, hosts and IP space that are no longer used, including CNAMEs, NS delegations, A records and SPF
include:entries for former providers.
Don't
Do not leave records pointing to decommissioned hosts or former providers. Dangling records can be claimed by others and used to send mail that appears to come from the domain.
Do not use wildcard DNS records.
This article explains domain, hostname terminology and domain alignment in email. Also, use aboutmy.email to check for email configuration setup.
How to check
Run dig against the subdomains and look for CNAMEs that resolve to a provider that no longer serves the domain.
2. Authentication
Authentication is how receiving mail servers verify that emails are authorized to send from the domain. Without SPF, DKIM, and DMARC properly configured, the domain is exposed to spoofing and phishing, and emails are more likely to be rejected or flagged by Spamhaus.
Do
Publish an SPF TXT record in the domain's DNS zone file that specifies exactly which IPs and hosts are authorized to send email on the domain's behalf.
Ensure the sending IP is explicitly included in the SPF record. Email sent from IPs not included in SPF will not pass SPF checks.
Make sure both the HELO domain and the envelope From domain have a valid SPF record. Publish SPF records on this domain (which might be the infrastructure domain) and not the visible header From domain.
Keep the SPF record within the 10 DNS lookup limit (this includes all nested
include:statements). Exceeding the limit returns a PermError, which is not a pass, so SPF cannot authenticate mail or satisfy DMARC alignment.
Keep the SPF record as narrow as possible. Only include the sending infrastructure actually in use.
Don't
Do not use overly permissive qualifiers like
+allor broadinclude:ranges that authorise IP space not under the sender's control.Do not leave
include:statements for providers no longer used for sending. Audit the SPF and remove outdated vendors. Check for typos.
Avoid using SPF macros unless needed. They are expanded per message at evaluation time, which is costly and makes failures more likely.
Do not use
aormxmechanisms whereip4:orip6:would work. Each one costs a DNS lookup against the limit of 10, whileip4:andip6:cost none.
How to check
Run dig TXT <domain>, then count the mechanisms that trigger a DNS lookup — include, a, mx, ptr, exists and redirect — and confirm the total is 10 or fewer.
Do
Ensure every outbound message carries a valid DKIM signature, using a minimum 1024-bit key length while 2048-bit is recommended.
Ensure that the
d=domain on the DKIM signature matches the domain on the header From.
Rotate DKIM keys at least annually, or immediately if a key is suspected to be compromised.
Use a different
d=domain for different mailstreams (for example, separate subdomains for transactional and marketing email), so that each mailstream builds its own reputation.
How to check
Run dig TXT <selector>._domainkey.<domain> (the selector is set in the ESP's DKIM setup page) and confirm a DKIM key, starting v=DKIM1, is returned.
Do
Publish a DMARC record with a policy defined for the sending domain.
Ensure the header From domain aligns with the DKIM signing domain (
d=) so that DMARC alignment passes.
Set up a DMARC aggregate report address (
rua=) from day one as this will help audit email sent from the domain.
Don't
Do not remain at
p=nonepermanently. Starting withp=noneis acceptable, but we recommend having an enforcement policy.
How to check
Run dig TXT _dmarc.<domain> and confirm a DMARC record, starting v=DMARC1, is returned.
3. Permission and List Hygiene
Send email only to people who want to receive it. Once the technical infrastructure is in place, the next step is building a legitimate list of email addresses from people who have provided explicit permission to receive the email. Lack of permission is one of the most common reasons for being listed by Spamhaus.
Do
Ensure all bulk email is ONLY sent to recipients that have Confirmed Opt-in (COI). Send a confirmation email requiring recipients to explicitly opt-in to verify their email address. This will prevent unwanted signups, bot signups and typo email addresses. If no opt-in is received, do not send email to that address.
Utilise available signals like bounce data, feedback loops, postmaster tools and engagement data to ensure the mailing list is up to date and email is sent to an engaged audience.
Keep a timestamped record of when and how permission was obtained.
Don't
Do not send emails to purchased, rented, or harvested lists, as these are the most common source of spam trap hits.
Permission is NOT transferable. Do not grant or assume permission retroactively or transfer it between organisations or domains.
How to check
Look for high bounce rates, low engagement and unusual sign-up patterns in the mailing platform.
Do
Refer to the guidelines from M3AAWG for managing spamtraps, and follow the best practices outlined in our resources.
Implement a robust email sunset policy to help remove temporary email sign-ups and email addresses that no longer engage with email.
Don't
Do not attempt to identify or suppress a spam trap address. Audit the acquisition process to identify which list segment or collection method introduced the problem address, and remove that source entirely.
Spamhaus spamtraps do not subscribe to email or engage with them.
According to M3AAWG spam trap best practices, mailboxes that remain inactive for more than 12 months can be repurposed as spamtraps.
4. Sending best practices
How email is sent matters as much as what is sent. Warming the IP and domain, maintaining a consistent volume, using trusted links and domains within emails, and providing clear, legitimate ways to opt-out of emails will help improve overall deliverability.
Do
HELO domains which DO NOT have a sending history will be subjected to additional filtering. Please read our best practices around IP/Domain warm-up.
Start sending slowly, and consistently for any IP address or domain that has not sent email in the past 90 days, before gradually increasing volume.
Domains which have been registered in the past 24 hours will be part of Spamhaus Zero Reputation Domains (ZRD) list.
Additionally, domains used for mailing within 30 days of registration will be treated suspiciously and we recommend following best practices for newly registered domains.
Treat any change in IP or HELO hostname as a new asset if no prior sending history is available, and apply the same warm-up process as used for a new IP or domain.
Begin with a few initial campaigns sent to the most engaged recipients to reduce the risk of hitting older invalid addresses. Maintaining a slow and consistent email volume will help build a strong sender reputation.
Don't
Do not use warm-up services that generate artificial traffic or simulate opens, clicks and replies. Using an engagement inflation service will result in the IP or domain being listed.
Infrastructure operated to inflate engagement or otherwise trick filters will be listed as a spam-enabling service.
Do not send inconsistent email volumes or trigger a sudden spike in sending, as this could negatively impact reputation.
Do not send to addresses which are old and unengaged while warming the IP or Domain.
Do not send the entire daily volume in a single burst at the top of the hour. Spread it across the day as spikes in mail volume can look suspicious.
Do not use more IPs than required to manage the mail volume as this can be perceived as snowshoe behaviour.
Do not begin sending on new infrastructure without carrying the suppression list across. Addresses that previously bounced or unsubscribed will otherwise be mailed again, and old inactive addresses are where recycled spam traps sit.
How to check
Plot the daily send volume for the IP or domain against the warm-up schedule and confirm it is increasing gradually, not spiking.
Do
Keep the overall bounce rate below 5%.
Suppress hard bounces immediately.
Investigate and remove repeated soft bounces after a defined threshold; this is typically 3–5 consecutive bounces.
Don't
Avoid using email list validation as a source to clean spamtraps as it does not do so, and is not and never will be a replacement for permission.
Do
Bulk commercial senders: Implement the
List-Unsubscribe-Post: List-Unsubscribe=One-Clickheader enabling one-click unsubscribe directly from the inbox (RFC 8058).Include a clearly visible unsubscribe link in the body of every commercial email.
Action unsubscribe requests within 2 days and add them to a suppression list.
Don't
Do not hide or obfuscate unsubscribe links.
Do not require recipients to authenticate to unsubscribe.
Avoid use of one-click unsubscribe in the body of an email; instead, make sure the link leads to a confirmation page.
How to check
Send a test campaign to a test mailbox, open the message headers (e.g. Gmail's "Show original"), and confirm that List-Unsubscribe and List-Unsubscribe-Post are both present. Also check that all links in the email work.
Do
Use HTTPS for all links, and only use links generated by the sender's own system.
Sign or validate tracking and redirect links so they cannot be altered to point elsewhere. This prevents malicious actors from abusing them as open redirects.
Don't
Do not use free or unbranded URL shorteners in the content of an email. URLs and/or domains used in the content of an email will affect the overall reputation of the sending domain.
5. IP and Domain Reputation
The reputation of the IP and domain as seen by Spamhaus can be checked via our reputation checker.
Spamhaus looks at multiple signals before assigning a reputation score, and a strong negative signal can outweigh the absence of positive ones — so following all email best practices consistently is essential.
Factors that influence reputation include: the service provider, the IP neighbourhood, the infrastructure the IPs are associated with, the upstream networks that connect to internet backbones, and the IP or domain's history — when it was first seen, when it was last used, and how it was used.
Do
Check the IP reputation and domain reputation regularly and do not wait for a delivery issue or listing to discover an issue.
Associate the domain with network providers and registrars that maintain a good reputation. The reputation of the hosting provider or registrar can be checked on our reputation statistics page.
Ensure newly registered domains are not used for at least 30 days from registration. The domain can be used for non-email purposes during this period, and establishing a web-presence prior to sending email will help improve the credibility of the domain.
Refer to our recommendations for best practices when using newly registered domains.
Don't
Do not use newly registered domains in SMTP as a FROM domain or a HELO domain unless the domain is properly warmed up. Similarly, using a newly registered domain in the content of the email can also look suspicious. The age of the domains used in the email can affect the overall sending reputation.
Do not use cousin domains for additional mailstreams or geographies for the same brand. Use sub-domains.
Do not hide WHOIS information for the root sending domain. The reputation of the upstream provider may be used for evaluating domain reputation. The reputation of the upstream provider can be checked in our Registrar reputation page.
How to check
Run the domain through the Reputation Checker to get more insights.
Note: We do not accept requests for explanations of the attributes shown here or requests to reset reputation.
6. ESPs & Large Senders
ESPs and shared infrastructure hosts are responsible for the email sent via their infrastructure. Hosting abusive senders will negatively impact the reputation of shared domains and infrastructure.