The SPF ptr mechanism is deprecated — replace it
The ptr mechanism asks a receiver to do a reverse DNS lookup on the connecting IP and then a forward lookup to confirm it. RFC 7208 §5.5 says it "SHOULD NOT be published" and that receivers may skip it entirely.
It costs one of your 10 lookups, adds latency to every check, and cannot be relied on. There is no reason to keep it.
How to fix it
- 1Identify which hosts the ptr mechanism was meant to authorize.
- 2Replace it with explicit ip4: / ip6: mechanisms, which cost zero lookups.
- 3Remove the ptr term and re-scan.
Check whether your domain has this problem
Free, no signup, about two seconds. You get the exact record to paste.
Related guides
- DKIM record with empty p= — a revoked key still in use
- SPF include points at a domain with no SPF record — a silent PermError
- DMARC record syntax errors that make receivers skip your policy
- DMARC external destination not authorized — why you receive no reports
- Two DMARC records at _dmarc — why your policy is being ignored