Microsoft IPv6 sender identity error
Fix Outlook 550 5.7.25 IPv6 reverse DNS
Microsoft uses 5.7.25 when an anonymous sending IPv6 address lacks reverse DNS. Configure PTR through the IPv6 network owner and publish coherent forward DNS for the resulting hostname.
The NDR states:
550 5.7.25 Access denied, the sending IPv6 address must have a reverse DNS record
The 550 response is permanent for that attempt. Configure the IP identity and send a new message.
Manual validation
- Confirm the final public IPv6 address from the NDR.
- Query its PTR record.
- Resolve the returned hostname through AAAA and confirm it includes the same IPv6 address.
- Compare the hostname with the outbound MTA's stable identity.
- Check Microsoft connector requirements if the path should not be anonymous.
How to fix it
Request PTR from the hosting or network provider controlling the IPv6 reverse zone. Publish the matching AAAA in the hostname's forward zone. If the application should submit through an authenticated provider rather than deliver directly over IPv6, correct that route instead.
Frequently asked questions
Does Outlook 5.7.25 apply specifically to IPv6?
Microsoft's documented message requires the anonymous sending IPv6 address to have reverse DNS.
Who changes IPv6 PTR?
The provider or network operator controlling the IPv6 allocation.
Does MailFixIt test IPv6 PTR today?
No. Use the manual reverse and forward DNS checks described here.
Related email diagnostics
Primary source: Microsoft Exchange Online NDR reference.