5.7.25: IPv6 sender without reverse DNS

What it means

For anonymous mail arriving over IPv6, Microsoft 365 requires the sending address to have a reverse DNS (PTR) record that resolves it to a domain name. Without one the message is refused. Microsoft documents the rule twice: as 5.7.25 with Access denied wording in its error code table, and as 450 4.7.25 with Service unavailable wording on its page about IPv6 mail flow. The temporary form makes the sender retry; the permanent form returns the message. Either way the record is missing on the sending side, and only whoever controls the IPv6 range can add it.

Common causes

• The IPv6 address the server sends from has no PTR record.
• The server picked an IPv6 address other than the one that was set up with reverse DNS.

How to fix it

1. 01Find the IPv6 address in the bounce and look up its PTR record.
2. 02Ask whoever controls the address range, usually your hosting or network provider, to publish a PTR record pointing to the server's host name.
3. 03Until the record exists, have the server send over IPv4 or from an IPv6 address that has one.

Sources

What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.

• Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com
• Mail flow in cloud organizations (support for anonymous inbound email over IPv6)learn.microsoft.com

Further reading

• PTR (reverse DNS) lookup