Mail server on a VPS: SPF, DKIM, DMARC

Installing Postfix or a ready-made bundle like Mailcow on a VPS takes an hour. Getting your mail into the inbox rather than spam is harder: mailbox providers look at the port, the server's address, its reputation and three DNS records. Here is what to check with the host before buying and how to set up SPF, DKIM and DMARC.

Updated 03.11.2026 · Find a VPS for your needs →

A mail server does two different jobs: it receives mail for your domain and sends your mail to other servers. Receiving almost always works right away if DNS has an MX record. Sending is harder: the receiving side decides whether to trust your server and checks the network, the address and the signatures to do so. If even one link is not set up, messages are rejected or land in spam without any notice.

Port 25 at hosting providers

Servers pass mail to each other over port 25. Ports 587 and 465 are for programs that hand a message to their own server; a message reaches someone else's MX server only via port 25. So the main condition for your own mail is an open outbound port 25.

Many hosts close it by default: new servers are often used to try sending spam, and the complaints and bad reputation fall on the host's addresses. According to the accsly catalog as of 3 November 2026, the port 25 terms could be established for 117 hosts: for 39% it is closed, for 37% it is opened on request, and for 24% it is open from the start. Large cloud platforms often close it for good, with no way to open it.

If the port is opened on request, the host usually wants to know the domain, what the mail is for, and sometimes that the server has been paid for more than a day. Say it plainly: "corporate mail for the domain, about N messages a day, no bulk mailings". To check the port on a server you already have: nc -vz -w 5 gmail-smtp-in.l.google.com 25 — if there is no connection, the port is closed on the host's side. Plans from hosts where the port is open or opened on request are in VPS for a mail server.

PTR and the server name

Google requires every sender's server address to have a reverse DNS record (PTR) that matches the forward one. The scheme: the server has a name, for example mail.example.com; that name's A record points to the server's address, the address's PTR points back to mail.example.com, and the server introduces itself with the same name in the HELO command. The PTR is set by the host, in the panel or through support. If mail also goes out over IPv6, the IPv6 address needs a PTR too. Details are in IPv4 and IPv6 on a server. On a NAT VPS without its own address you cannot set your own PTR, and such a server is not suitable for mail.

IP address reputation

A VPS address could have belonged to anyone before you. If spam was sent from it, it may be on public lists of known spam sources (DNSBL), and some mailbox providers will reject your mail from day one. Before launch, check the address in public reputation lookup services; if it is listed, ask the host for another one or file a removal request — most lists have such a form.

A new clean address has a different problem: it has no history, and the big providers treat it with caution. Start with a small volume of mail to real recipients and increase it gradually. Google requires keeping the share of messages that recipients mark as spam below 0.3%; you can watch it in the free Google Postmaster Tools. Bulk mailings are better sent through a separate service, or at least from a separate address and subdomain, so that their reputation does not affect your working mail.

SPF: who may send on behalf of the domain

SPF (RFC 7208) is a TXT record at the domain root listing the servers allowed to send mail on its behalf. The receiving server checks it against the envelope sender address (MAIL FROM) and the HELO name.

example.com.  TXT  "v=spf1 mx ip4:203.0.113.10 -all"

mx and ip4: are your servers; if mail also goes out through an external service, add its include:.
-all means everyone else is not allowed to send (fail), ~all means "probably not" (softfail), handy while you are setting things up.
A domain must have exactly one SPF record. Mechanisms that need DNS lookups (include, a, mx, exists, redirect) may be used no more than 10 times including nested ones; beyond that the check returns an error (permerror) and SPF does not work at all.

DKIM: signing messages

DKIM (RFC 6376) is a digital signature over a message's headers and body. The server signs every message with a private key, and the public key is published in DNS under selector._domainkey.example.com. The recipient verifies the signature and confirms that the message was sent by the domain in the signature and was not altered on the way.

mail2026._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

The RSA key length must be at least 1024 bits, as RFC 8301 and Gmail require; 2048 is recommended. Keys are generated by OpenDKIM, rspamd or the panel of a mail bundle, which will also give you the ready record. The selector is there for key rotation: publish the new key under a new selector, switch signing over, and delete the old record a few days later, once the messages already sent have been checked.

DMARC: policy and reports

DMARC (RFC 7489) ties SPF and DKIM to the From address the recipient sees. A message passes DMARC if SPF or DKIM passed and its domain matches the domain in From (by default a match of the organisational domain is enough). The record is published under the name _dmarc:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

p=none means monitor only, p=quarantine sends messages that fail DMARC to spam, p=reject rejects them.
rua is the address for daily aggregate reports: they show who sends mail on behalf of the domain and from which addresses.

Start with p=none, read the reports for 2–4 weeks, make sure all your legitimate mail sources pass, then move to quarantine and then to reject.

What Gmail and Outlook require

Since 1 February 2024 Gmail has required every sender to have SPF or DKIM, a correct PTR record, delivery over TLS and a spam complaint rate below 0.3%. Those who send more than 5,000 messages a day to Gmail addresses need SPF and DKIM together, a DMARC record (p=none is enough) with the From domain matching the SPF or DKIM domain, and one-click unsubscribe in marketing mail. Since 5 May 2025 Outlook.com has applied similar rules to senders of 5,000+ messages a day: SPF and DKIM must pass, DMARC must be at least p=none with a domain match; messages without this go to the Junk folder or are rejected.

For a small server the conclusion is simple: set up all three records at once, even if you send little. To check the result, send a message to your own Gmail mailbox and open "Show original": it shows the SPF, DKIM and DMARC results.

When you do not need your own mail server

Your own server makes sense if you need control over mailboxes and data, or many addresses on several domains. If the site only needs to send notifications and port 25 is closed, it is simpler to send through an external mail service on port 587: SPF, DKIM and DMARC are still set up for your domain. A server with full mail and spam filtering needs 2 GB of memory; plan disk space with room for mailboxes and backups. When a site and its mail should move from shared hosting to a VPS is covered in When to move from shared hosting to a VPS.

FAQ

Why does my VPS not send mail?

Most often the host has closed outbound port 25. In the accsly catalog it is closed at 39% of hosts with known terms and opened on request at another 37%. Check the port and write to support.

Can I send mail over port 587 instead of 25?

Only to your own or an external mail service that then delivers the message. Other mail servers accept mail from servers on port 25.

What are SPF, DKIM and DMARC in plain words?

SPF is the list of servers allowed to send mail on behalf of the domain. DKIM is a signature proving that the domain sent the message and it was not altered. DMARC is the policy: what to do with messages that fail these checks and where to send reports.

Do I need DMARC if I send little mail?

Yes. Gmail strictly requires DMARC from senders of more than 5,000 messages a day, but for a small server a p=none record costs nothing, and the reports show who sends mail on behalf of the domain.

How long should a DKIM key be?

At least 1024 bits; 2048 is recommended. If the DNS panel does not accept a long TXT record as one string, split it into several quoted strings within a single record.

Why does mail from my own server go to spam?

Usually a PTR record, SPF, DKIM or DMARC is missing, or the address has a poor reputation: it is on lists of known spam sources or brand new. Check the message headers in Gmail and the address in reputation lookup services.

Plans on this topic

Best VPS hosting 2026

More in the guide

Cloud server or VPSA cloud server and a VPS are usually the same KVM virtual machine. The difference lies in what surrounds it: a cloud sells resources by the hour through an API and offers network disks, snapshots and ready-made services, while a classic VPS is a fixed monthly plan with a local disk and a traffic allowance. Here is which of this you actually need and what it costs.
Dedicated server or VPSA VPS is a slice of a physical server, a dedicated server is the whole machine. With 4 cores and 8–16 GB of memory a VPS costs almost half as much, with 4 cores and 32 GB the prices are equal, and with 64 GB on 8 cores or 128 GB on 16 cores a dedicated server in the catalog is a third cheaper than a virtual one. Here is what else changes besides the price: neighbours, guarantees, delivery time, hardware failures and remote management.
Shared hosting or VPS for a websiteShared hosting is a ready place for a site where the host looks after the server. A VPS is your own server where you set everything up. For a landing page or an ordinary WordPress site, hosting is enough and costs several times less. You need a VPS when the account limits are too tight for the site or when it needs software that hosting does not allow. Below is what each option includes, what it costs and a table to help you choose.
DDoS protection: what hosting providers actually give youEvery second host now lists "DDoS protection" in its plans. Behind that line there may be multi-terabit filtering, or only the right to take your address offline when an attack bothers the neighbours. Here is what protection is made of, how L3/L4 differs from L7, and how to tell from the contract what you are buying.
Server monitoring: uptime, load, alertsWithout monitoring you learn that the server is down from your visitors, and that the disk is running out when the database stops writing. A few checks from outside and a dozen metrics from inside are enough to see a problem before users do. Here is what to measure, where to run checks and how to do it for free.
How to read hosting plans: the hidden limitsA plan card shows cores, memory, disk and a monthly price. Yet two plans with identical numbers can cost different amounts a year later and behave differently under load. The difference lies in terms printed in small type, in the acceptable use policy, or only in the contract. Below are eight places worth checking before you pay.
IPv4 and IPv6 on a serverA typical VPS has one public IPv4 address and, if the host supports it, an IPv6 subnet. An extra IPv4 address almost always costs money, and the cheapest plans sometimes come without their own IPv4 at all. Here is where the shortage comes from, what you can do with IPv6 alone and which address settings a mail server needs.
Bandwidth and traffic: what 1 Gbps and unlimited really meanA server plan usually has two network lines: port speed and traffic volume. The first says how fast the server can send data, the second how much it can send in a month. They are linked by simple arithmetic, and once you know it, it is easy to see what "1 Gbps unlimited" actually offers and whether "5 TB" will be enough for you.
Docker on a VPS: getting startedDocker lets you run a bot, a website, a database and monitoring on one server without them getting in each other's way, and moving to another VPS comes down to copying a couple of files and the data. Installation takes five minutes; the real trouble starts later: database ports exposed to the internet, logs growing to tens of gigabytes and data that vanished along with a container. Here is how to avoid all of that from the start.
How to move a website from shared hosting to a VPSThe move itself takes a couple of hours; the mistakes usually happen around it: a forgotten cron job, .htaccess rules that nginx does not read, an AAAA record with the old address, or mail that disappeared along with the IP change. Below is the order of steps with commands and checks for a PHP and MySQL site.
Server control panels: ISPmanager, FASTPANEL, aaPanelA panel turns a VPS into the kind of dashboard you know from shared hosting: sites, databases, mail and certificates are set up with a few clicks instead of editing config files. The three panels most often installed on Russian and budget international servers are ISPmanager, FASTPANEL and aaPanel. They differ in price, memory requirements and how much of the server they take over.
Windows VPS for 1CA rented server for 1C saves you from the office PC under a desk that nobody updates or backs up. But 1C on a VPS has its own quirks: the software licence is tied to the parameters of the virtual machine, users need both 1C and Windows licences, and core speed matters more than core count. Here is how to put together a 1C server for a small company.
Windows VPS: licensing, RDP and secure sign-inA Windows server costs more than Linux not only because of memory: the price includes a licence, and how it is arranged decides whether you are compliant and how many people can connect. An exposed RDP port is also the most common way such servers get hacked. Here are both topics.
When to move from shared hosting to a VPSA VPS does not make a site faster by itself: it gives you resources and freedom, and with them the job of running a server. Here is how to tell that hosting has become too small, when the problem can be solved without moving, and how to migrate a site so visitors notice nothing.
VPS backups: strategies and toolsOn a VPS, backups are your job, even if the plan says "backups included". We go through what exactly to back up, why a host snapshot is not enough, how to set up restic or BorgBackup in half an hour, and how to make sure you can actually restore from a backup.
First 10 steps after buying a VPS: securityBots start guessing passwords on a new server within minutes of it getting a public IP. Below are ten steps that close the most common holes in about an hour: commands for Ubuntu and Debian, the differences for AlmaLinux and Rocky Linux, and the checks that keep you from locking yourself out of your own server.
How to choose a country for your serverPut the server where your visitors are. For an audience across Europe, Germany, the Netherlands and Finland are convenient; for North America, the US East Coast. If you serve EU users, keeping the data in the EU makes GDPR simpler. Price hardly decides it: at the same host a server in Frankfurt, Amsterdam or New York usually costs the same, and only Asia and Australia are noticeably more expensive.
Hourly billing: when it pays offHourly billing pays off if you need the server for less than three weeks a month: for a test, a build, a one-off heavy job. At most hosts an hour costs exactly the monthly price divided by 730 hours, so over a full month you hardly overpay. The overpayment hides elsewhere: hourly plans are dearer on average, and for a server that runs all year, monthly billing or a year paid in advance usually comes out cheaper.
How much RAM and how many cores a website needsMost websites are fine with 2 GB of memory and one or two cores; a shop with thousands of products needs 4 GB and two cores. Memory matters more than cores: when it runs out, the site slows down or crashes, while an extra core without memory adds almost nothing. Below I show how to work out the memory for your site and how to see what it actually uses.
KVM or OpenVZ: which to chooseIn 2026 KVM is almost always the right pick: it costs a dollar or two more per month than OpenVZ, but everything runs on it, from Docker to Windows. OpenVZ makes sense in one narrow case, explained below, and at the end you will find the commands to check your own server in a minute.
NVMe or SSD: does it matter for a websiteFor a small site the difference between NVMe and SSD is barely noticeable, because pages are served from memory rather than from disk. It shows up in shops and sites with a large database. At the same host NVMe costs only about $0.50–1 a month more, and sometimes less, so what usually decides it is not the disk type but its size and how the host has limited it.
What is a VPS, in plain EnglishA VPS is a slice of a powerful physical server that you rent and that behaves like a separate computer, with its own operating system, its own IP address and full control. Below is how it differs from shared hosting, who needs one, what it costs and what to check right after you buy it.
VPS for a Telegram bot: what the bot needs and how to pick a planA bot with a menu and a few commands runs fine on the cheapest server, while a bot with broadcasts, files and a database hits completely different limits. Here is what a bot really consumes, which Telegram limits shape the choice of server and how to avoid overpaying.
How to test VPS ping and speed before you payThe numbers in a plan do not tell you the latency to your users or how fast the disk really is. Most of this can be measured before you pay, the rest in the first hour after launch. Here are the tools and how to read the results.
Corporate network on a VPS: remote access to the officeA rented server can become the hub of a company's private network: remote employees and branch offices connect through it to the ERP, file server, CRM and Git. Here are the common layouts, protocols, server requirements and security basics.
How to choose a VPS: the 7 specs that matterTwo plans with the same "2 cores, 4 GB, 50 GB" can differ several times in speed and twice in price a year later. Here is what stands behind each line of a VPS plan and what to check before you pay.
VPS vs VDS: is there a difference and what actually mattersIn most markets VPS and VDS mean the same thing: a virtual server. The difference that really affects your work is hidden not in the name but in the virtualization type and whether resources are guaranteed.