Spamhaus publishes Sender Guidelines, with DNS enforcement starting November 2026

On October 21, 2026, the Spamhaus Project published its Sender Guidelines, a single reference for anyone running a mail server, from a small business to an email service provider. Spamhaus says the advice already existed across FAQs, blog posts and support tickets. Its one-line summary: "Only send email to people who have asked for it and make sure your sending infrastructure is set up properly."

What the guidelines cover

The main document has six parts: minimum requirements, infrastructure and DNS, permission and list hygiene, authentication, sending best practices, and IP and domain reputation. A separate page covers ESPs and large senders, which Spamhaus holds responsible for everything sent through their platforms.

DNS enforcement from November 2026

The item with a date is the one to act on. Spamhaus writes: "Starting in November 2026, we're gradually rolling out enforcement of basic DNS requirements over several months." Every sending IP will need a valid HELO hostname, a reverse DNS (PTR record) and a matching A record, so the PTR name resolves back to the same IP. Placeholder HELO names such as localhost, hosting-provider defaults and hostnames that imitate Gmail or Hotmail are prohibited. Spamhaus has published a HELO/DNS checker for a single IP.

The numbers Spamhaus names

• Confirmed opt-in for every subscriber; purchased, rented or harvested lists are prohibited and are called the most common source of spam trap hits.
• Overall bounce rate below 5%, hard bounces suppressed immediately.
• DKIM keys of at least 1024 bits, 2048 recommended, with the d= domain matching the From domain. DMARC is required, and staying at p=none permanently is discouraged.
• One-click unsubscribe for bulk commercial mail, processed within 2 days.
• No email from a domain registered less than 30 days ago. Domains under 24 hours old go onto the Zero Reputation Domains list.
• Warm-up services that simulate opens, clicks or replies "result in listing".
• For ESPs: automated review when an account exceeds 5% bounces or 0.3% complaints, and a permission pass for addresses inactive over 12 months.

How this compares with mailbox-provider rules

The authentication and unsubscribe items mirror the Gmail, Yahoo and Microsoft sender requirements in force since 2024, which we summarize in our sender requirements guide. The difference is the consequence. A mailbox provider filters your mail; a Spamhaus listing can get it rejected by every receiver that queries the blocklist. The DNS rules also go further: the provider guidelines ask for a valid PTR record but say nothing about a matching HELO.

What to check now

This section is our analysis. Run every outbound IP through our reverse DNS checker and confirm the PTR name resolves back to the IP and matches the HELO your MTA announces. Shared-pool senders should ask their provider the same question. Then audit list sources against the confirmed opt-in rule, which Spamhaus calls one of the two most common reasons for a listing.