MailFixIt

Microsoft IPv6 sender identity error

Outlook 550 5.7.25: Access denied, the sending IPv6 address must have a reverse DNS record

Microsoft uses 5.7.25 when an anonymous sending IPv6 address lacks reverse DNS. Configure PTR through the IPv6 network owner and publish coherent forward DNS for the resulting hostname.

Problem description

The NDR states:

550 5.7.25 Access denied, the sending IPv6 address must have a reverse DNS record
Automated diagnosis: enter the sending IPv6 address. MailFixIt queries its PTR record and confirms that the returned hostname resolves back through AAAA.

Run the automated PTR test

Enter your domain and sending IP. MailFixIt checks PTR and forward DNS automatically and shows the evidence.
Is this temporary or permanent?

The 550 response is permanent for that attempt. Configure the IP identity and send a new message.

Manual validation

  1. Confirm the final public IPv6 address from the NDR.
  2. Query its PTR record.
  3. Resolve the returned hostname through AAAA and confirm it includes the same IPv6 address.
  4. Compare the hostname with the outbound MTA's stable identity.
  5. Check Microsoft connector requirements if the path should not be anonymous.

How to fix it

Request PTR from the hosting or network provider controlling the IPv6 reverse zone. Publish the matching AAAA in the hostname's forward zone. If the application should submit through an authenticated provider rather than deliver directly over IPv6, correct that route instead.

Frequently asked questions

Does Outlook 5.7.25 apply specifically to IPv6?

Microsoft’s documented message requires the anonymous sending IPv6 address to have reverse DNS.

Who changes IPv6 PTR?

The provider or network operator controlling the IPv6 allocation.

Does MailFixIt test IPv6 PTR today?

Yes. Enter the sending IPv6 address to check PTR and confirm that its hostname resolves back through AAAA.

Related email diagnostics

Gmail 451 4.7.23: The sending IP address doesn't have a PTR record, or forward DNS doesn't matchFix Gmail 451 4.7.23 when a sending IP lacks PTR or forward-confirmed reverse DNS and mail is temporarily rate limited. Gmail 550 5.7.25: This message was blocked because the sending IP address doesn't have a PTR record, or forward DNS doesn't reference the sending IP addressFix Gmail 550 5.7.25 by making the sending IP's PTR hostname resolve forward to the same IP. Outlook 550 5.7.506: Access Denied, Bad HELOFix Microsoft 365 and Outlook 550 5.7.506 by correcting the SMTP HELO or EHLO hostname and its DNS identity.

Primary sources: Microsoft Exchange Online NDR reference.