# IPv6 email deliverability: what you need before sending over IPv6

URL: https://iblockspam.com/blog/ipv6-email-deliverability-requirements
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> Sending mail over IPv6? What Gmail and Microsoft require, why IPv6 gets less benefit of the doubt, SPF ip6 syntax, IPv6 PTR checks and forcing IPv4 in Postfix.

## Short answer

To send over IPv6, each sending IPv6 address needs a PTR record whose host name has a matching AAAA record, and your mail must pass SPF or DKIM. Gmail rejects IPv6 mail that misses its PTR and authentication rules, and Microsoft 365 requires both. Add ip6 ranges to SPF, or force outbound mail to IPv4 until IPv6 is set up properly.

Many mail servers start sending over IPv6 without anyone deciding they should. The host gets an IPv6 address, the receiver's MX has one too, and the mail server prefers the newer protocol. Then mail to Gmail bounces while IPv4 mail was fine. This guide explains what receivers require for IPv6, why they're stricter about it, how to set up SPF and reverse DNS for IPv6, and how to force outbound mail back to IPv4 while you fix things.

## Why does IPv6 change email deliverability?

Receivers lean heavily on the sending IP address to judge mail. With IPv4, addresses are scarce, so a spammer who burns one has to find another. With IPv6, a single customer can be given more addresses than the whole IPv4 internet. Spamhaus notes that IPv6 lets senders discard addresses cheaply, which is one reason "IP reputation is less important than the reputation of domains and content for inbox placement" ([Spamhaus](https://www.spamhaus.org/resource-hub/deliverability/how-does-email-reputation-work/)).

So receivers ask IPv6 senders to prove more up front: a working reverse DNS record and passing authentication. And because a fresh IPv6 address has no history, it doesn't inherit the reputation your IPv4 address built. Our guide to [sender reputation](https://iblockspam.com/blog/what-is-sender-reputation) covers the wider picture.

### Are you already sending over IPv6?

Check before you assume. If your server has a public IPv6 address and outbound IPv6 works, it may already be using it. For example, Postfix's documentation marks `inet_protocols = all` as the default (older installs upgraded from Postfix 2.8 or earlier may have `ipv4` set explicitly). With both protocols enabled, the client "will choose the protocol as specified with the smtp_address_preference parameter," which defaults to `any` ([Postfix](https://www.postfix.org/postconf.5.html)).

To confirm, open a recent message you sent to Gmail or Outlook.com in the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). If the first `Received` line added by the receiver shows an address with colons, such as `2001:db8::25`, you sent over IPv6.

## What do Gmail and Microsoft require for IPv6?

### Gmail

Google's [sender guidelines](https://support.google.com/mail/answer/81126?hl=en) apply to everyone who sends to Gmail:

- "The public IP address of a sending SMTP server must have a corresponding PTR record that resolves to a hostname."
- That host name "must also have an A (for IPv4) or AAAA (for IPv6) record that resolves to the same public IP address."
- All senders must set up SPF or DKIM; bulk senders need SPF, DKIM and DMARC.

Google's troubleshooting section, **Fix IPv6 authorization errors**, says an error "could mean that the PTR record for the sending server isn't using IPv6." The error looks like this:

```text
550-5.7.1: Message does not meet IPv6 sending guidelines regarding PTR records and authentication.
```

If you send through an email service provider, Google says to "confirm they're using an IPv6 PTR record."

### Microsoft 365

Microsoft documents its rules for [anonymous inbound email over IPv6](https://learn.microsoft.com/en-us/defender-office-365/mail-flow-about). It says Microsoft 365 supports it, "but it might not be enabled in your organization." Where it isn't, senders over IPv6 see `550 5.2.1 Service unavailable, [contoso.com] does not accept email over IPv6`.

Where it is enabled, the sending server must meet both requirements:

| Requirement | Error if missing |
|---|---|
| The source IPv6 address has a valid PTR record | `450 4.7.25 Service unavailable, sending IPv6 address [...] must have reverse DNS record.` |
| The sender's domain passes SPF or DKIM | `450 4.7.26 Service unavailable, message sent over IPv6 [...] must pass either SPF or DKIM validation.` |

Both are `450` temporary errors, so your server keeps retrying and the mail sits in the queue until it expires or you fix the cause.

Other receivers vary. Many apply the same idea: no PTR or no authentication over IPv6 means a rejection, a deferral or the spam folder. Our [550 5.7.25](https://iblockspam.com/smtp-errors/550-5-7-25) and [550 5.7.1](https://iblockspam.com/smtp-errors/550-5-7-1) pages cover the related error codes.

## Why can an IPv6 address be blocklisted when you did nothing wrong?

Blocklists can't track IPv6 one address at a time in the way they track IPv4. Spamhaus's Combined Spam Sources (CSS) list, for example, "lists /64 subnets of IPv6 addresses," and may extend listings "to larger blocks" when spam comes from many /64s in the same network ([Spamhaus](https://www.spamhaus.org/blocklists/combined-spam-sources/)).

Spamhaus calls a /64 "the industry standard for the smallest IPv6 allocation to individual customers." Some hosting providers instead put several customers in the same /64. If one of them sends spam, your address is listed too. Spamhaus's advice to customers in that position is to ask their provider for a dedicated /64.

For a mail server, that means:

- Ask your provider whether your IPv6 address is in a /64 shared with other customers.
- If it is, request a dedicated /64, or send over IPv4 only.
- Check the list's own lookup page for IPv6 listings. Our [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker) checks an IPv6 address on the public lists that publish IPv6 data, and marks the rest as not tested.

## How do you set up SPF for IPv6?

Add your IPv6 sending addresses with the `ip6` mechanism. [RFC 7208, section 5.6](https://www.rfc-editor.org/rfc/rfc7208.html#section-5.6) defines it, and says "If ip6-cidr-length is omitted, it is taken to be "/128"," a single address.

| Goal | SPF term |
|---|---|
| One IPv6 address | `ip6:2001:db8:1234::25` |
| A whole /64 | `ip6:2001:db8:1234::/64` |
| IPv4 and IPv6 for the same server | `ip4:192.0.2.25 ip6:2001:db8:1234::25` |
| Hosts named in A/AAAA records | `a:mail.example.com` |

A full record might look like this:

```text
v=spf1 ip4:192.0.2.25 ip6:2001:db8:1234::25 include:_spf.google.com ~all
```

Two details catch people out:

1. **`a` and `mx` follow the connection type.** RFC 7208 says the `a` mechanism does a lookup "using the type of lookup (A or AAAA) appropriate for the connection type." If your record uses `a` or `mx` and the host has no AAAA record, IPv6 mail fails SPF even though IPv4 passes.
2. **Your provider's include may already cover IPv6.** Large providers' SPF includes often list `ip6` ranges. Your own servers aren't covered unless you add them.

`ip4` and `ip6` don't count toward SPF's 10-lookup limit. For the rest of the syntax, see [SPF record syntax and examples](https://iblockspam.com/blog/spf-record-syntax-examples), and check the result with the [SPF Checker](https://iblockspam.com/tools/spf-checker).

DKIM doesn't care which protocol carried the message, so signing every message with an aligned DKIM key protects you if SPF misses an IPv6 address. See [what is DKIM](https://iblockspam.com/blog/what-is-dkim).

## How do you set up reverse DNS (PTR) for IPv6?

IPv6 reverse DNS works like IPv4 but uses a different zone. [RFC 3596](https://www.rfc-editor.org/rfc/rfc3596.html#section-2.5) says an IPv6 address is written "by a sequence of nibbles separated by dots with the suffix ".IP6.ARPA"," in reverse order. That's 32 hexadecimal digits, so let your provider's panel or `dig` build it for you.

1. **Pick the exact sending address.** If the server has several IPv6 addresses, the one it uses for outbound connections must be the one with the PTR. In Postfix, set it with `smtp_bind_address6`, "an optional numerical network address that the Postfix SMTP client should bind to when making an IPv6 connection."
2. **Create the AAAA record first.** For example, `mail.example.com AAAA 2001:db8:1234::25`.
3. **Ask the address owner to set the PTR.** Only your hosting provider or ISP controls the reverse zone. Set it to `mail.example.com`.
4. **Match HELO.** Use the same host name as your server's HELO or EHLO name.
5. **Check it.** Run `dig -x 2001:db8:1234::25 +short`, then `dig mail.example.com AAAA +short`, or use the [PTR Lookup](https://iblockspam.com/tools/ptr-lookup), which checks forward confirmation for IPv6 addresses against AAAA records.

Our full guide to [reverse DNS for mail servers](https://iblockspam.com/blog/reverse-dns-ptr-records-for-mail-servers) covers naming and common mistakes.

## How do you force outbound mail to use IPv4?

If you can't get a proper IPv6 PTR, a dedicated /64 or SPF in place quickly, send over IPv4 until you can. Don't just change the preference.

### Postfix

The Postfix documentation is specific. The setting `smtp_address_preference = ipv4` "is not a solution for remote servers that flag email received over IPv6 as more 'spammy'," because it only sets which address type is tried first. Instead, it says to "configure Postfix to receive mail over both IPv4 and IPv6, and to deliver mail over only IPv4":

```text
/etc/postfix/main.cf:
    inet_protocols = all

/etc/postfix/master.cf:
    smtp ...other fields... smtp -o inet_protocols=ipv4
```

In practice, keep the existing fields on the `smtp unix` line in your `master.cf` and add `-o inet_protocols=ipv4` to it, then run `postfix reload`.

Setting `inet_protocols = ipv4` in `main.cf` also works, but it turns off IPv6 for receiving too, and Postfix warns "you MUST stop and start Postfix after changing this parameter."

### Other servers and services

Other mail servers have equivalent settings to disable IPv6 for outbound delivery or bind to a chosen address; check your server's documentation. If you send through a hosted email provider or relay, ask the provider whether it sends over IPv6 and whether those addresses have PTR records, as Google suggests.

## IPv6 sending checklist

| Check | Pass condition |
|---|---|
| Know which protocol you send over | Headers of a test message show the receiving server saw an IPv4 or a known IPv6 address |
| Fixed outbound IPv6 address | Server binds to one address, not a random one in the range |
| PTR record | The IPv6 address has a PTR naming your mail host |
| Forward confirmation | That host name's AAAA record returns the same IPv6 address |
| HELO name | Matches the PTR host name |
| SPF | `ip6` term (or correct AAAA for `a`/`mx`) covers the address |
| DKIM | Every message signed with an aligned key |
| Dedicated /64 | Not shared with other customers |
| Blocklists | IPv6 address and /64 not listed |

## Next steps

- Send a message to a Gmail address and read the headers to see which protocol you used.
- Run your sending IPv6 address through the [PTR Lookup](https://iblockspam.com/tools/ptr-lookup) and your domain through the [SPF Checker](https://iblockspam.com/tools/spf-checker).
- Use the [Deliverability Test](https://iblockspam.com/tools/deliverability-test) to see SPF, DKIM, DMARC and reverse DNS for a real message.
- If IPv6 isn't ready, force outbound mail to IPv4 now and fix IPv6 properly later.
- Use iBlockSpam's [outbound relay](https://iblockspam.com/features/outbound-relay) if you'd rather send through a smart host than run your own outbound IP reputation.

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### Why does Gmail reject my mail over IPv6 but accept it over IPv4?

Usually because the IPv6 address has no PTR record, its PTR name has no matching AAAA record, or the message fails SPF and DKIM because your SPF record lists only IPv4. Gmail's error reads 550-5.7.1, Message does not meet IPv6 sending guidelines regarding PTR records and authentication. Fix the PTR and SPF, or send over IPv4.

### How do I add an IPv6 address to my SPF record?

Use the ip6 mechanism, for example ip6:2001:db8:1234::25 for one address or ip6:2001:db8:1234::/64 for a range. Without a prefix length, RFC 7208 treats it as /128, a single address. The a and mx mechanisms also match AAAA records when the connection is over IPv6, so check those hosts have the right AAAA records.

### Should I just disable IPv6 on my mail server?

You don't need to disable it everywhere. Postfix's documentation suggests receiving over both IPv4 and IPv6 but delivering over IPv4 only, by setting inet_protocols=ipv4 on the smtp transport in master.cf. That keeps inbound IPv6 working while outbound mail uses your established IPv4 reputation.

### Does Microsoft 365 accept email over IPv6?

Yes, but Microsoft says it might not be enabled for your organization. When it is, the sending IPv6 address must have a valid PTR record and the sender must pass SPF or DKIM. Otherwise Microsoft returns 450 4.7.25 for missing reverse DNS or 450 4.7.26 for failed authentication.

### Why was my IPv6 address blocklisted when I never sent spam?

Blocklists often list IPv6 by /64 block rather than single address. Spamhaus's CSS lists /64 or larger blocks. If your host gives several customers addresses in the same /64, someone else's spam can list you. Ask your provider for a dedicated /64 for your mail server.

## Sources

- [Gmail Help: Email sender guidelines (IP addresses; Fix IPv6 authorization errors)](https://support.google.com/mail/answer/81126?hl=en)
- [Microsoft Learn: Mail flow in Microsoft 365 (support for anonymous inbound email over IPv6)](https://learn.microsoft.com/en-us/defender-office-365/mail-flow-about)
- [RFC 7208: Sender Policy Framework (SPF), sections 5.3, 5.4 and 5.6](https://www.rfc-editor.org/rfc/rfc7208.html#section-5.6)
- [RFC 3596: DNS Extensions to Support IP Version 6 (section 2.5, IP6.ARPA)](https://www.rfc-editor.org/rfc/rfc3596.html#section-2.5)
- [Postfix: postconf(5) manual (inet_protocols, smtp_address_preference, smtp_bind_address6)](https://www.postfix.org/postconf.5.html)
- [Spamhaus: Combined Spam Sources (CSS), IPv6 listings](https://www.spamhaus.org/blocklists/combined-spam-sources/)
- [Spamhaus: How does email reputation work? (2022)](https://www.spamhaus.org/resource-hub/deliverability/how-does-email-reputation-work/)

## Free tools for this guide

- [Reverse DNS (PTR) Lookup](https://iblockspam.com/tools/ptr-lookup): Check PTR records, forward-confirmed reverse DNS and generic-looking host names.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [Email Deliverability Test](https://iblockspam.com/tools/deliverability-test): Send one email and see its SPF, DKIM and DMARC results, reverse DNS, blocklists, TLS and spam verdict.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.

---

Source: iBlockSpam, https://iblockspam.com/blog/ipv6-email-deliverability-requirements (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt