HELO / EHLO problems
The SMTP HELO/EHLO hostname is missing, invalid, or inconsistent with reverse DNS.
- Reading time:
- 5 min
- Difficulty:
- Intermediate
- Estimated duration:
- 5 min
- Prerequisites:
- None
- Last updated:
- 2026-07-15
- Author:
- empire
Problem summary
The SMTP HELO/EHLO hostname is missing, invalid, or inconsistent with reverse DNS.
Severity: High
Symptoms
- Filters cite HELO/EHLO or reverse DNS mismatch
- Outbound HELO uses an unrelated or IP-literal hostname
Possible causes
- Misconfiguration
- Incomplete rollout
- DNS propagation delay
How to diagnose
- Confirm the symptom in headers or reports
- Inspect the relevant DNS records
- Validate with a trusted checker
How to fix
- Correct the DNS or signing configuration
- Re-test and confirm alignment where required
How to verify
- Re-check DNS
- Send a test message
- Confirm expected authentication results
Prevention
- Document changes
- Monitor reports after deployment
When to escalate
- Production mail is failing authentication after a change window
Related Learn Articles
Related Problems
- CNAME at zone apexA CNAME is placed at the zone apex where other record types are also required.
- Inconsistent authoritative answersAuthoritative name servers for the same zone return conflicting data.
- Incorrect MX targetMX points to the wrong host name or unreachable mail server.
- Missing glue recordsDelegation references in-bailiwick name servers without required glue.
- MX record missingNo MX record is published for a domain that should receive mail.
- NXDOMAIN for expected nameA name that should exist returns NXDOMAIN from authoritative servers.
- Reverse DNS mismatchPTR (reverse DNS) for a sending IP is missing or does not match the forward hostname used in mail.
- Stale DNS cache after changeResolvers still serve prior answers after an authoritative change because TTL has not expired.
- Wrong TTL for cutoverTTL values are too high for a planned cutover, prolonging mixed old/new answers.
Related Toolbox Tools
- digCLI DNS lookup utility for authoritative and recursive inspection of mail-related records.
- nslookupInteractive DNS lookup utility commonly used for quick MX and TXT checks.
- Google Admin Toolbox DigBrowser-based dig-style DNS lookup from Google’s Admin Toolbox.
- Google Admin Toolbox CheckMXGoogle Admin Toolbox Check MX for inbound mail DNS sanity checks.