What 550 5.7.25 means
5.7.25 is registered as 'Reverse DNS validation failed'. Gmail requires every sending IP to have a PTR record, and the hostname in that PTR must resolve back to the same IP (forward-confirmed reverse DNS). If either half is missing, Gmail rejects with 550 5.7.25.
Microsoft uses 5.7.25 for the same check on IPv6: a sending IPv6 address must have a reverse DNS record. If you send from a Gmail or Microsoft 365 mailbox, the IPs are Google's or Microsoft's and are configured correctly; this error points to a self-hosted server, a VPS, or a low-end SMTP provider.
What the bounce looks like
The wording providers document for this code. Your bounce may add an IP address, a session ID or a help link after it.
550 5.7.25 This message was blocked because the sending IP address doesn't have a PTR record, or the forwarding DNS entry doesn't reference the sending IP address. Gmail requires that sending IP addresses have a PTR record.550 5.7.25 Access denied, the sending IPv6 address [address] must have a reverse DNS record451 4.7.23 The sending IP address for this message doesn't have a PTR record, or the PTR record's forward DNS entry doesn't match the sending IP address. To protect users from spam, your email has been temporarily rate limited.Temporary version of the same check.
Why cold emailers see 550 5.7.25
- A self-hosted mail server on a VPS or cloud instance where reverse DNS was never set.
- A PTR that points to a generic hostname (e.g. the provider's default) that doesn't resolve back to the IP.
- Sending over IPv6 from a host where only IPv4 reverse DNS is set.
How to fix 550 5.7.25
- Find the sending IP in the bounce or your server logs.
- Set a PTR record for that IP through whoever owns the IP (your VPS or hosting provider's control panel, not your domain's DNS). Use a hostname like mail.yourdomain.com.
- Create an A (or AAAA) record for that hostname pointing back to the IP, and use the same name in your server's HELO/EHLO.
- If you don't control the IP, move sending to a provider that does this properly.
Retry or suppress?
Don't suppress the recipient. Fix reverse DNS, then resend. Gmail's temporary versions are 451 4.7.23 and a 421 4.7.0 variant with similar text.
Reading the code
The basic code 550 means "Mailbox unavailable or message refused (permanent)" under RFC 5321. In 5.7.25, the 5 is the class (permanent failure) and the 7 is the subject (security or policy). The detail number 25 is registered in RFC 3463 / the IANA registry as "Reverse DNS validation failed".
- Class 5
- Permanent failure
- Resending the same message won't work. Something about the message, the recipient or the sender has to change first.
- Subject 7
- Security or policy
- A security or policy decision: spam filtering, authentication, blocklists, permissions.
- Detail 5.7.25
- Reverse DNS validation failed
Check the rest of your setup
Run your sending domain through the SPF, DKIM & DMARC checker to see which record fails, then follow how to set up SPF, DKIM and DMARC. Paste the headers of a test message into the email header analyzer to confirm all three pass.
Got a different bounce? Paste it into the SMTP error code lookup to decode it.