mx.ptr.missing

FCrDNS Mismatch on MX Host

What we check

For each MX IP address, we look up its PTR record and then forward-resolve that PTR hostname back to an IP. This is Forward-Confirmed reverse DNS (FCrDNS): the PTR hostname must exist and resolve back to the same IP that we queried. This finding fires when the PTR is missing entirely, or when the PTR hostname does not forward-resolve back to the probed IP.

This is a per-IP check — each resolved IP for each MX hostname is verified independently. Different IPs on the same MX hostname can produce different results.

What this finding means

The MX IP address lacks a valid FCrDNS entry. Either no PTR record exists for the IP, or the PTR hostname does not resolve back to the same IP. The mail server cannot cryptographically prove its identity through reverse DNS.

Note: we use the loose FCrDNS form — the PTR hostname must forward-resolve back to the probed IP, but it does not need to match the MX hostname. Large providers never satisfy that stricter check (Google's MX PTRs are *.1e100.net, IONOS are *.kundenserver.de-style). The stricter PTR-vs-MX comparison is reported separately as mx.ptr.hostname_differs (informational, unscored).

Why it matters

Spam filtering signal. Many receiving servers and spam filters check FCrDNS. A missing or broken reverse DNS entry is a classic indicator of dynamically assigned consumer IP space — the kind of IP that sends spam, not legitimate mail.
Deliverability impact. Gmail, Microsoft, and other major providers may defer or reject mail from IPs without valid FCrDNS, especially for new or low-reputation senders.
M3AAWG best practice. The Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) recommends that every mail-sending IP have a PTR record that forward-resolves (FCrDNS).

How to fix

The PTR record is managed by the IP address owner — typically your hosting provider — not in your domain's DNS zone. This is the most common source of confusion: you cannot fix PTR records by editing your registrar's DNS.

Find out who controls the IP's reverse DNS. For cloud providers (AWS, Hetzner, DigitalOcean), it is usually configurable in the server dashboard. For dedicated servers, contact your hosting provider.
Set the PTR record to a hostname that forward-resolves back to the IP:
```
IP:    192.0.2.1
PTR:   mail.example.com.
A:     mail.example.com. → 192.0.2.1
```
The PTR hostname does not have to match the MX hostname, but it must forward-resolve back to the same IP.

Verify FCrDNS:

# Step 1: PTR lookup
dig +short -x 192.0.2.1
# Expected: mail.example.com.

# Step 2: Forward resolve
dig +short A mail.example.com
# Expected: 192.0.2.1 (same IP)

How it's graded

A missing or failed FCrDNS carries a 15-point deduction in the MX category. See Grading Methodology for the full scoring model.

Evidence example

IP: 192.0.2.1 (MX target: mail.example.com)
PTR: (none)
FCrDNS: FAIL — no PTR record for this IP