Running your own mail server: the deliverability checklist

What it means

When you run your own mail server on a VPS or dedicated server, nobody manages reputation and setup for you. Gmail and Outlook do not know your IP. They judge it only on what they can check: names, DNS records, signatures, encryption and behaviour. One missing piece is often enough to land in spam.

Why it matters

A new IP has no history, so receivers are strict with it. Big providers handle this for Google Workspace or Microsoft 365 users. On your own server, each item below is your job.

How to check

Send an email from the server to your test address on the home page (/). The report covers SPF, DKIM, DMARC, reverse DNS, blacklists and SpamAssassin in one go. Use /domain-scanner for the DNS side and /blacklists for the IP.

The checklist

1. Port 25 is open outbound

Many hosting companies block outgoing port 25 on new accounts. Check their documentation and ask support to unblock it if needed.

2. A clean name and reverse DNS

1. Pick a name like mail.yourdomain.com and create an A record pointing to the server IP.
2. Ask your host to set the PTR (reverse DNS) of the IP to that same name.
3. Use the same name in Postfix:

   myhostname = mail.yourdomain.com

3. SPF

Add the server IP to your SPF record:

v=spf1 ip4:203.0.113.10 ~all

4. DKIM with OpenDKIM

1. Install OpenDKIM and generate a 2048-bit key:

   opendkim-genkey -b 2048 -d yourdomain.com -s mail

2. Publish the content of mail.txt as a TXT record on mail._domainkey.yourdomain.com.
3. Connect it to Postfix in main.cf (the port must match your OpenDKIM socket):

   smtpd_milters = inet:localhost:8891
   non_smtpd_milters = $smtpd_milters
   milter_default_action = accept

5. DMARC

Start in monitoring mode with a TXT record on _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

6. TLS encryption

Get a certificate (for example from Let's Encrypt) for mail.yourdomain.com, then:

smtpd_tls_cert_file = /etc/letsencrypt/live/mail.yourdomain.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.yourdomain.com/privkey.pem
smtpd_tls_security_level = may
smtp_tls_security_level = may

7. No open relay

Only your own users may send through the server:

mynetworks = 127.0.0.0/8 [::1]/128
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination

8. Good habits

• Check that your IP is not on a blacklist before you start.
• Increase volume slowly over several weeks.
• Read /var/log/mail.log for rejection messages: they usually explain the problem.
• Keep the system updated and use strong passwords for mailbox accounts.

After editing main.cf, reload Postfix with postfix reload.

Check that it is fixed

Send a new test from the server to the home page address. Every section should pass: SPF and DKIM aligned with your domain, a matching reverse DNS, no blacklist and a low spam score.