Spamhaus, the organization behind some of the email blocklists most widely used by mailbox providers and network operators, has published an official sender handbook for the first time: the Spamhaus Sender Guidelines. It announced it on October 21, 2026, and it's not just a best-practices document. It comes with a date: starting in November 2026, Spamhaus will begin to gradually require, over several months, that every IP that sends email have a valid HELO, a reverse DNS record (PTR) and a matching A record. If you have a Postfix on a VPS that sends notifications, invoices or password resets, this applies to you, not just to the big players sending millions of emails.
What Spamhaus published
According to the announcement, the question it gets asked most is what you have to do to stay off its lists. The answer, it says, hasn't changed in 20 years: send email only to people who asked for it and have your infrastructure properly configured. What's new is that this guidance used to be scattered across FAQs, blogs and support tickets, and now it lives in one place.
The document is divided into six areas: minimum requirements, infrastructure and DNS, authentication, permission and list hygiene, sending practices, and IP and domain reputation. There's also a separate page dedicated to email service providers (ESPs) and large senders. Spamhaus clarifies that these aren't new rules: they come from the RFCs, from mailbox provider practices and from what responsible senders already do, with more weight on DNS and infrastructure. In the acknowledgments it mentions Laura Atkins, Jennifer Nespola Lantz and Matthew Vernhout, well-known names in the deliverability world.
Al Iverson, at Spam Resource, frames it as Spamhaus following the path of Google, Yahoo and Microsoft, which have already published their own sender requirements. At Word to the Wise they summed it up as "very clear, very precise and overall very good".
The five minimum requirements
Spamhaus says all senders must meet these five points to avoid being listed:
- Confirmed opt-in for all subscribers. Each person confirms their address with a click in a confirmation email. If they don't confirm, you don't send them anything. Purchased, rented or scraped lists are, according to Spamhaus, the most common source of spamtrap hits.
- Forward-confirmed reverse DNS (FCrDNS). The sending IP must have a PTR pointing to a fully qualified domain name (FQDN), and that name must resolve back to the same IP.
- A HELO/EHLO that resolves to the sending IP and is the same on every connection.
localhost, the hosting provider's default names or a HELO that changes between connections are treated as a sign of misconfiguration or a compromised machine. - IPv6 with a /64 allocation or larger and valid reverse DNS, if you send over IPv6.
- SPF, DKIM and DMARC. SPF and DMARC published for every domain that sends, every message signed with DKIM, and the signing domain aligned with the From domain.
If your infrastructure doesn't meet the DNS requirements, Spamhaus warns that your IPs may end up on its CSS list (IPs that send spam) or on the XBL (compromised IPs).
What's going to hurt the most: DNS and HELO
Spamhaus writes in its announcement that "DNS is its thing" and that it's also the other most common cause of listings, almost always because of an invalid HELO, a missing PTR or an A record that doesn't match. A misconfigured server, it says, is easily mistaken for a compromised one or for a spammer.
The specific rules:
- The PTR must not be generic. No
static-203-0-113-25.hosting.example.neton dedicated IPs. It recommends a PTR using your own domain and no random words. - The HELO must match the PTR whenever possible, and Spamhaus suggests having a web page on that domain explaining what it's for or redirecting to the main brand.
- Never imitate the HELO of Gmail or Hotmail, and don't make the HELO name resolve to machines that don't send.
- DNS cleanup: remove CNAMEs, delegations, A records and SPF
include:entries for providers you no longer use. Dangling records can be claimed by third parties. It also doesn't want wildcard records.
To check it, Spamhaus put a HELO and DNS checker on the same guidelines page: you enter your IP and it tells you what's failing. It warns that it doesn't return results for every IP and may not reflect recent changes. You can also send an email to helocheck@abuseat.org to see which HELO your server is announcing.
A practical note if your server lives on DigitalOcean: according to their documentation, a Droplet's PTR is created automatically from the name you gave it in the dashboard. If your Droplet is called ubuntu-s-1vcpu-1gb-sfo2-01, that's your PTR. My take: renaming it to something like mail.yourdomain.com, with its A record pointing to the IP, is one of the cheapest fixes you'll make this year.
Authentication, with numbers
The guidelines put numbers where there used to be vague recommendations:
| Topic | What Spamhaus asks for |
|---|---|
| SPF | Maximum of 10 DNS lookups counting nested include: entries; if you go over, the result is PermError and it doesn't count as a pass. No +all |
| DKIM | Minimum 1024-bit key, 2048 recommended; rotate it at least once a year |
| DMARC | Defined policy and alignment with DKIM's d=; starting at p=none is fine, staying there forever is not |
| Bounces | Overall rate below 5% (requirement) |
| Unsubscribes | One-click unsubscribe header (RFC 8058) for bulk commercial sends; process the unsubscribe within 2 days at most |
It also asks that both the HELO domain and the envelope sender (MAIL FROM) domain have valid SPF, and that Gmail or Hotmail addresses not be used as the envelope sender.
Reputation: new domains and traps
A few points worth keeping on your radar:
- Domains registered in the last 24 hours go onto its zero reputation domains list (ZRD), and those used to send within their first 30 days are treated with suspicion.
- Using "warm-up" services that simulate opens, clicks and replies ends in a listing. Infrastructure that inflates engagement is listed as a service that facilitates spam.
- Any change of IP or HELO name without history is treated as a new asset, with its own warm-up.
- No free URL shorteners in the content, and no "cousin" domains to separate flows: use subdomains.
- According to the M3AAWG guidance that Spamhaus cites, mailboxes inactive for more than 12 months can be recycled as spamtraps.
For those who run a sending platform
The page for ESPs and large senders asks that each customer send from their own subdomain, with the PTR and HELO of their brand when possible. It asks you to separate transactional IPs from marketing ones, maintain a monitored abuse mailbox, and watch each account for volume spikes, bounces above 5% and complaints above 0.3%, with automatic throttling or review when those are exceeded. On shared pools it recommends double-signing with DKIM, using both the ESP's domain and the customer's.
My take
None of this is exotic. Anyone who has fought with deliverability already knew almost all of it. What changes is that there's now an official document that whoever blocks you can point you to, and a date for the DNS part. What worries me most isn't the big ESPs, which already have this sorted, but the forgotten servers: the VPS that sends alerts from an internal system, the WordPress with its own Postfix, or the Droplet with the name the dashboard gave it by default. Those are the ones that will start bouncing silently when the gradual enforcement kicks in. Before that happens, it's worth checking three things: the PTR of each IP, the A record for that name, and the HELO your server announces.
Sources
- Spamhaus Sender Guidelines (documento oficial)
- One clear set of rules: the Spamhaus Sender Guidelines (anuncio de Spamhaus, 21 de octubre de 2026)
- ESP & Large Sender Guidelines (Spamhaus)
- Spamhaus Releases Sender Guidelines (Spam Resource)
- Spamhaus' Sender Guidelines (Word to the Wise)
- How to Create, Edit, and Delete DNS Records (documentación de DigitalOcean)