SMTP error 5.7.25 Reverse DNS validation failed

What SMTP error 5.7.25 means

The receiving server took the IP address your mail arrived from, looked up its PTR record and was not satisfied. Either no PTR exists, or the hostname it returns does not resolve back to the same address, or the name looks like a generic broadband allocation. It comes back as 550 5.7.25 and concerns the connecting address alone; nothing about the message content is involved.

Security or policy status
Sent by The receiving mail server, checking the IP address that opened the connection
Occasional

What SMTP error 5.7.25 Reverse DNS validation failed actually means

Forward-confirmed reverse DNS is the oldest cheap sanity check in email. The receiver asks who owns this address, gets a hostname from the reverse zone, resolves that hostname and expects the original address back. Properly run mail servers have this arranged; compromised home routers and hastily built cloud instances do not, which is why the check still earns its place. The practical catch is that only the network operator can create a PTR record, because it lives in the reverse zone for the IP block rather than in your own domain. Registered as permanent only, so an office that sends directly can lose an entire day of mail before anyone notices.

This status code is returned when an SMTP client's IP address failed a reverse DNS validation check, contrary to local policy requirements.
— RFC 7372

How 5.7.25 appears in a bounce

A server reporting this condition sends it alongside a three-digit reply code, and a bounce prints the two together. The registry lists 550 5.7.25 as the pairing for this status.

The leading 5 is the server's verdict rather than part of the code's identity: it marks this as a permanent failure, which means the sending server has given up and returned the message.

What causes SMTP error 5.7.25 on a business phone system

Sending directly from an office broadband connectionA multifunction printer scanning to email, an on-premise application server, or an old mail server nobody decommissioned, all talking straight out to port 25. Business broadband addresses seldom have a meaningful PTR configured.
A cloud instance carrying the provider's default nameThe generic hostname a hosting provider assigns does resolve, so the lookup succeeds, but it matches a pattern receivers associate with throwaway sending and it will not match anything you announce in HELO.
HELO and PTR telling different storiesThe server greets as mail.yourcompany.co.uk while the PTR returns something entirely different. Strict receivers require the greeting, the reverse record and the forward record to agree, and a mismatch fails the check even though a PTR exists.
A static IP reissued after a circuit changeMove provider, or accept a re-address during a fibre upgrade, and the reverse record does not travel with you. Mail carries on working for lenient recipients and starts failing against the strict ones.
The connection was made over IPv6Several large receivers apply reverse DNS requirements more firmly to IPv6 than to IPv4. A server that has quietly preferred an IPv6 route since an upgrade will be checked against a reverse zone nobody has ever populated.

How to fix SMTP error 5.7.25

Stop sending directly and relay through your mail platformThis removes the whole class of problem. Point devices and applications at authenticated submission on port 587 with a service account, so mail leaves from addresses that already have correct reverse DNS.
Ask the ISP or hosting provider to set the PTROnly they can write to the reverse zone. Give them the exact hostname you want and confirm afterwards by querying the address rather than trusting the ticket update.
Make the three names agreeThe HELO greeting, the PTR for the address and the forward A record for that name should form a closed loop. Check all three explicitly, because two out of three still fails against a strict receiver.
Cover IPv6 or turn it off for mailEither populate the reverse zone for the IPv6 address as well, or configure the sending host to use IPv4 for SMTP. Leaving it to chance means intermittent failures that correlate with nothing obvious.
Check the address separately against policy block listsDynamic and residential ranges are frequently listed regardless of PTR. Getting reverse DNS right will not lift a listing, so if failures continue after the PTR is correct, that is where to look next.

Fixing the underlying problem

This page explains the code. These guides walk through the fix in detail.

Questions about SMTP error 5.7.25

Can we fix this in our own DNS?

No, and this is the part that surprises people. Reverse records live in a zone controlled by whoever owns the IP address block, which is your internet provider or your hosting company. You can only raise a request with them.

Our website is fine, so why does email care about reverse DNS?

Because web browsers never perform the check and mail servers routinely do. It is a convention specific to SMTP, used as a rough filter for hosts that were never intended to send mail, and a perfectly healthy web presence tells you nothing about it.

How quickly can an ISP add a PTR record?

Usually a change request completed within hours, occasionally a few days. If mail is stopped right now, moving the sending device onto your mail platform restores service faster than waiting for the ticket.

Is this the same as being on a blacklist?

No. This is a structural check on how the address is registered in DNS, and a brand new address with no history at all can fail it. A block list rejection is a reputation decision and normally comes back as 5.7.1 naming the list involved.

Related SMTP status codes

Source. SMTP error 5.7.25 Reverse DNS validation failed is defined in RFC 7372 and registered in the IANA SMTP Enhanced Status Codes registry. The causes and fixes above are drawn from our own experience supporting UK business email systems.

All Email delivery & SMTP codes