Reverse DNS and PTR Records for Email Deliverability

Default answer: A PTR record maps a sending IP back to a hostname. Forward-confirmed reverse DNS (FCrDNS) passes when that hostname’s A or AAAA record includes the same IP. You cannot publish a PTR next to MX and DKIM in Cloudflare. The IP owner sets it in the reverse zone. If you send through a hosted mailbox or transactional platform, confirm FCrDNS on the connecting IP and spend your effort on SPF, DKIM, DMARC, and list hygiene. Branded rDNS is only your job when you control a dedicated sending IP.

PTR vs A record: two lookups in opposite directions

An A (or AAAA) record answers “which IP does this hostname use?” A PTR record answers the reverse: “which hostname does this IP claim?” Receivers look at the TCP connection, not at your website.

Example of a consistent pair on a dedicated mail host:

1. Forward: mta1.mail.example.com → A → 203.0.113.10
2. Reverse: 10.113.0.203.in-addr.arpa → PTR → mta1.mail.example.com

FCrDNS is those two lookups agreeing. If the PTR returns a name whose A/AAAA set does not include the original IP, the pair is broken. Generic rDNS such as a raw ISP hostname is better than nothing and worse than a stable mail hostname the operator actually uses in HELO/EHLO.

IPv6 needs its own PTR under ip6.arpa and a matching AAAA. An IPv4 PTR does not cover an IPv6 connection.

Why receivers still care in 2026

Missing or nonsense reverse DNS is a cheap spam signal. It is not a substitute for aligned SPF, DKIM, and DMARC—those remain the authentication layer, explained in SPF, DKIM, and DMARC explained. rDNS only answers “does this connecting IP look like mail infrastructure?”

Gmail and Yahoo have treated valid forward and reverse DNS as a sender baseline since 2024. Microsoft high-volume guidance from May 2025 onward expects the same on connecting IPs. That requirement applies to the sending IP in the SMTP session, not the website A record on example.com. A mail-tester “no rDNS” flag on your homepage IP is usually a misread.

A passing PTR also does not guarantee inbox placement. Reputation, complaints, authentication alignment, and content still decide the folder. Background: Why your emails go to spam.

You cannot set a PTR in your domain’s Cloudflare zone

PTR records live in the reverse tree owned by whoever holds the IP block:

• IPv4: in-addr.arpa
• IPv6: ip6.arpa

Your company zone holds MX, DKIM CNAMEs, SPF, DMARC, and custom MAIL FROM. It does not hold the PTR for an IP you do not announce. Pasting a PTR-shaped TXT on the apex does nothing. Asking Cloudflare DNS for “a PTR record on example.com” is the wrong console.

Who sets it:

• Hosted mailbox / ESP / transactional platform — the provider owns the sending IPs and publishes provider-named PTRs on the pool.
• VPS, colo, or dedicated IP you rent — the IP owner (cloud, ISP, or RIR customer of record) sets the PTR. You open a ticket; you do not edit your domain zone.

If you send through a hosted platform (including ArawaMail)

Treat rDNS as provider-managed. ArawaMail’s sending docs publish DKIM CNAMEs plus custom MAIL FROM MX and SPF through Cloudflare when you enable outbound. They do not document PTR, HELO, dedicated IPs, or customer-visible sending-IP hostnames. Do not invent those controls, and do not demand that a shared pool PTR display your brand while other tenants use the same IP.

Custom MAIL FROM is bounce-domain alignment (Return-Path). It is not reverse DNS. Keep that split; the header roles are in From, Reply-To, and Return-Path.

Practical check:

1. Send a message to a mailbox you control.
2. Open the raw source. Read the receiving MTA’s Received headers and note the connecting IP—not your website IP.
3. Look up PTR on that IP, then A/AAAA on the hostname you got. Both directions should agree.
4. If FCrDNS passes to the provider’s mail hostname, stop. Move on to SPF lookup count, DKIM selectors, and DMARC policy. Tools and related checks live on the email tools page, SPF 10 DNS lookup limit, and DKIM key rotation.

Connecting the domain itself is still your job: zone match, receiving, then sending. That path is How to connect a Cloudflare domain to ArawaMail.

If you own the sending IP

Branded reverse DNS becomes your problem only when the IP is yours to announce. Pattern:

• One stable mail hostname per IP, for example mta1.mail.example.com.
• A and PTR form an FCrDNS pair.
• HELO/EHLO matches or clearly relates to that hostname. HELO does not need to match the visible From domain.
• Request the PTR from the IP owner. Wait for the reverse zone to publish before you send volume.

Do not buy a dedicated IP just to print your brand in a PTR. A dirty domain on a new IP still lands in spam; the buy/wait decision belongs in a later dedicated-IP piece, not here. SMTP port choice (25 vs 465 vs 587) is also separate—see SMTP ports 25, 465, and 587.

How we analyzed this

The mechanics of PTR and FCrDNS are stable RFCs and operator practice. The product constraint is current ArawaMail documentation: enable-sending and Cloudflare-requirements cover MX, DKIM, SPF, and MAIL FROM write access. They do not expose a PTR editor or a dedicated-IP SKU. Gmail, Yahoo, and Microsoft bulk-sender language is applied only to connecting mail IPs. Claims about “set PTR in Cloudflare for your domain” were rejected because the reverse zone is not that zone.

Common mistakes

• Testing the website A record instead of the connecting IP from Received headers.
• Pasting a PTR as TXT on example.com and expecting Gmail to read it.
• Demanding a shared-pool PTR show your brand while other customers send from the same address.
• Assuming IPv4 rDNS covers IPv6.
• Treating a green PTR as inbox placement. Authentication and complaints still dominate.

FAQ

What is a PTR record in email?
A DNS record in the IP owner’s reverse zone that maps an IP to a hostname. Receivers use it as a cheap check that the connecting host looks like mail infrastructure.

What is FCrDNS?
Forward-confirmed reverse DNS: PTR(IP) returns a name, and that name’s A/AAAA set includes the original IP.

Can I set a PTR record in Cloudflare DNS for my domain?
No. Cloudflare on example.com is the forward zone. PTR is published by the IP owner in in-addr.arpa or ip6.arpa.

Does my From domain have to match the PTR hostname?
No. HELO/PTR should agree with each other. From alignment is SPF/DKIM/DMARC’s job.

Who sets PTR when I use ArawaMail or another hosted sender?
The provider that owns the sending IPs. ArawaMail docs do not give customers a PTR control.

When is branded reverse DNS my problem?
When you control a dedicated sending IP and can ask the IP owner to publish a hostname you also put in A/AAAA and HELO.

Does a passing PTR guarantee inbox placement?
No. It is a baseline on the connecting IP, not a reputation score.