Reverse DNS, SPF and DKIM: before you send email from a VPS

Running a mail server is a project, not a setup step

Receiving servers judge mail by reputation and by how well your DNS is set up. A new server on a shared address range, with no records, often lands in spam or is rejected, whatever the software. Most small sites are better off sending through an authenticated relay service and using their own domain's records, and running a full mail server only when they need one.

If you do run one, you will need reverse DNS, SPF, DKIM and DMARC, an open outbound port 25, a clean IP address and ongoing care.

Check reverse DNS

Reverse DNS, or a PTR record, maps your server's IP address back to a host name. Mail servers check it. It should match the name your server announces, and that name should resolve back to the same IP. The owner of the IP address block sets the PTR, so look in your control panel for a reverse DNS option, or ask support if there is none.

dig +short -x YOUR_SERVER_IP
dig +short A mail.example.com
hostname -f

Test whether outbound mail is allowed

Many hosts block outbound port 25 on new servers to limit spam. Test a connection to a public mail server from your VPS. If it times out, the port is blocked, and you need your provider to open it or you should send through a relay on port 587 or 465 instead. Do not try to work around a block.

timeout 8 bash -c '</dev/tcp/smtp.gmail.com/25' && echo "port 25 open" || echo "port 25 blocked or filtered"
timeout 8 bash -c '</dev/tcp/smtp.gmail.com/587' && echo "port 587 open" || echo "port 587 blocked"

Publish an SPF record

SPF lists the servers allowed to send mail for your domain. Add a TXT record at the domain apex. This example allows the domain's MX hosts and one IP address, and rejects others softly with ~all. If you also send through a relay, add its include mechanism exactly as the provider documents it.

v=spf1 mx ip4:YOUR_SERVER_IP ~all

dig +short TXT example.com

Set up DKIM

DKIM signs your outgoing mail with a private key, and receivers check the signature using a public key published in DNS. Your mail software generates the key pair. Publish the public part as a TXT record at selector._domainkey.example.com, where the selector is a name you choose, such as mail2026. Relay services give you the records to add.

dig +short TXT mail2026._domainkey.example.com

Add a DMARC record

DMARC tells receivers what to do with mail that fails SPF and DKIM, and where to send reports. Start with a monitoring policy of p=none, read the reports for a few weeks, then tighten to quarantine or reject once legitimate mail passes.

v=DMARC1; p=none; rua=mailto:[email protected]

dig +short TXT _dmarc.example.com

Send a test and read the headers

Send a message to an address you control at a large provider and open its original headers. Look for spf=pass, dkim=pass and dmarc=pass. Free mail-testing services also score a message and list problems. Check that your IP address is not on a public blocklist.

dig +short 4.3.2.1.zen.spamhaus.org