550 5.7.25 — Forward-confirmed reverse DNS failed (Yahoo)
Retrying will not help. The message will not be delivered.
The reply
550 5.7.25 Forward-confirmed reverse DNS failed.Your sending IP has no reverse DNS record, or the name it returns does not resolve back to that same IP. This is the most mechanical rejection there is: it is a DNS configuration mistake, it is entirely yours to fix, and it costs nothing to fix.
What it means
Forward-confirmed reverse DNS is a round trip. The receiver takes your IP, looks up its PTR record to get a hostname, then looks that hostname up again and checks the answer includes the IP it started with. Both directions must agree. A missing PTR, a PTR pointing at a name with no A record, or a name resolving to a different address all fail it. Every serious receiver checks this and several besides Yahoo reject outright on failure.
Why it happens
- No PTR record on the sending IP at all — the default for most fresh cloud instances.
- A PTR pointing at a hostname that has no matching A record.
- A PTR whose hostname resolves to a different IP than the one sending.
- A generic provider-assigned PTR, which some receivers treat as no better than none.
- A HELO/EHLO name that does not match the PTR, which fails the related checks even when the PTR itself is fine.
What to do
- Set the PTR record for the sending IP. It is set at whoever gave you the IP — your hosting or cloud provider — not in your own DNS zone.
- Publish an A record for that same hostname pointing back at the IP, so the round trip closes.
- Use the same hostname in your HELO/EHLO greeting as the PTR returns.
- Verify from outside: look up the PTR, then look up the name it gives you, and confirm the IP comes back.
- Do this for every IP that sends, not only the primary one — a secondary that was never configured fails only some of the time, which is harder to spot.
Questions
Where do I set a PTR record?
With whoever controls the IP address — your hosting or cloud provider, through their console or a support request. It is not something you can add to your own DNS zone, which is why it gets missed.
I have a PTR and it still fails.
Then the reverse half works and the forward half does not. Take the hostname the PTR returns and look it up: it needs an A record pointing back at the same IP. A name that resolves nowhere, or somewhere else, fails the check.
Is the provider's default PTR enough?
It passes the mechanical check, but a generic name in a provider's pool carries no reputation and some receivers weigh it against you. A hostname on your own domain is better.