When attempting to send an email to Gmail or Google Workspace recipients, your mail server may receive an immediate bounce reading: 550 5.7.25: The sending IP does not have a PTR record, or the corresponding forward DNS entry does not point to the sending IP. This error indicates a complete failure of Google’s Forward-Confirmed Reverse DNS (FCrDNS) check. Google enforces this security requirement to confirm the authenticity of sending mail servers and block unverified mail relays.
Quick Answer
Error 550 5.7.25 means your sending IP address lacks a valid reverse DNS (PTR) record or its reverse hostname does not match its forward A record. To fix it, request a custom PTR record from your ISP or cloud host, and create a matching A record in your domain’s DNS.
Understanding the 550 5.7.25 Rejection
Gmail requires every server connecting to its MX gateways (smtp.google.com or aspmx.l.google.com) to have a verifiable identity. When your mail transfer agent (MTA) opens a connection to Google:
- Google records the remote IP address (IPv4 or IPv6).
- Google performs a reverse DNS query (
PTR) on that IP address. - If no PTR record is returned, Google issues the
550 5.7.25rejection. - If a PTR record is returned (for example,
mail.example.com), Google immediately performs a forward DNS lookup (AorAAAA) onmail.example.com. - If the forward lookup does not return the original sending IP address, the connection fails the alignment check and is rejected with
550 5.7.25.
[Your Sending Server: 203.0.113.10]
│
▼
[Google Inbound MX Server]
1. Queries PTR for 203.0.113.10
Result: mail.example.com
│
2. Queries A record for mail.example.com
Result: 203.0.113.10
│
Do the IP addresses match?
┌────────┴────────┐
YES NO
│ │
Validation 550 5.7.25 ERROR
Passes "Corresponding forward DNS entry
does not point to the sending IP"
Diagnostic Steps: Finding the Broken Link
You can trace the breakdown in the FCrDNS chain using standard command-line tools.
Step 1: Retrieve the Sending IP from the Bounce
Examine the diagnostic text inside the Non-Delivery Report (NDR). Note the sending IP:
550-5.7.25 [203.0.113.10] The sending IP does not have a PTR record, or the
550-5.7.25 corresponding forward DNS entry does not point to the sending IP.
550-5.7.25 Please visit <https://support.google.com/mail/?p=SenderPermError>
For guidance on extracting connection data from email metadata, see How to Read Gmail “Original Message” Headers.
Step 2: Test the Reverse DNS Query
Query public DNS for the reverse pointer of that IP:
dig -x 203.0.113.10 +short
- Result is blank: The PTR record is completely missing.
- Result returns a hostname (e.g.,
mail.example.com): Proceed to Step 3.
Step 3: Test the Forward DNS Query
Query the forward A record for the hostname returned in Step 2:
dig mail.example.com A +short
- Result does not match
203.0.113.10: You have a forward/reverse mismatch. Ifmail.example.comreturns a different IP (e.g.,198.51.100.50), Google flags this as a spoofing risk and drops the message.
Step-by-Step Fixes
Fix 1: Establish Forward and Reverse Alignment
To create a fully aligned FCrDNS configuration, you must coordinate between your domain’s DNS host and the company that provides your IP address.
- Create the Forward A Record:
In your domain’s authoritative DNS zone (e.g., Cloudflare, Route 53, GoDaddy), add anArecord pointing to your mail server’s IP:- Host/Name:
mail(producingmail.example.com) - Value:
203.0.113.10 - TTL:
300(short TTL for rapid updates)
- Host/Name:
- Create the Matching PTR Record:
Log in to your ISP portal or cloud console (AWS, Azure, DigitalOcean, Linode) and configure the reverse DNS pointer for203.0.113.10:- IP:
203.0.113.10 - Target/Hostname:
mail.example.com
For step-by-step instructions across specific hosting providers, see Resolving “PTR Record Missing” for SMTP Relay.
- IP:
Fix 2: Align the SMTP HELO/EHLO Banner
Mail servers must introduce themselves using the same fully qualified domain name that matches their reverse DNS.
- Open your mail server’s configuration file (e.g.,
/etc/postfix/main.cffor Postfix, or the Send Connector settings in Microsoft Exchange). - Set the
myhostnameor HELO parameter to match your reverse DNS:myhostname = mail.example.com - Restart your mail service. If your server introduces itself as
localhost, a local NetBIOS name, or an unresolvable hostname, Google may reject the connection even if the PTR record is valid.
Fix 3: Managing IPv6 Addresses
A common trap occurs when an on-premises mail server or VPS has both IPv4 and IPv6 connectivity enabled:
- If your server defaults to outbound IPv6 (e.g.,
2001:db8::1), it will connect to Gmail’s IPv6 endpoints. - If you only configured a PTR record for your IPv4 address (
203.0.113.10), Google will evaluate the IPv6 connection, find no PTR record in the.ip6.arpazone, and reject the email with550 5.7.25.
To resolve this:
- Option A: Configure a corresponding PTR record and forward
AAAArecord for your IPv6 address. - Option B: Force your mail transfer agent to use IPv4 exclusively for outbound internet delivery. In Postfix, edit
/etc/postfix/main.cf:
Save the file and reload Postfix (postfix reload).inet_protocols = ipv4
Verifying the Resolution
Once you have applied your forward and reverse DNS records, DNS propagation will take time depending on your provider’s TTL settings. If you suspect your resolver cache has not updated, see How to Fix DNS Propagation Lag for New Domains.
After the records propagate, send a test email to a personal Gmail address. Once delivered, view the raw message headers and verify the Received: header:
Received: from mail.example.com (mail.example.com. [203.0.113.10])
by mx.google.com with ESMTPS id ...
for <recipient@gmail.com>;
If Google resolves the hostname cleanly in the parenthesis without an error comment, your FCrDNS setup is complete and compliant with Google’s sender standards. If you encounter further delivery blocks after fixing reverse DNS, review your domain authentication status in How to Fix Gmail Error 550 5.7.26: SPF Missing/Invalid.