Self-hosting email is not hard to install. It is hard to make deliverable. This guide covers everything you need in place before the software matters, so you find out now instead of after your first message lands in spam.
1. Port 25 has to be open
Outgoing SMTP uses port 25, and almost every provider blocks it by default, including us. That block exists because a compromised server sending spam ruins the IP reputation of everyone else on the range.
To get it opened on a D4 VPS, open a ticket and tell us what you are running and roughly how much mail you expect. We open it for real use.
If you skip this step, everything else still installs fine and nothing you send ever arrives. Do it first.
2. Reverse DNS on the sending address
Receiving servers look up your IP and expect a hostname back. No PTR record, or a PTR pointing at a generic provider hostname, is treated as a spam signal on its own.
Set it to the hostname your mail server introduces itself as, for example mail.example.com. On a D4 VPS this is self-service on the Networking tab; our reverse DNS guide covers it. Many hosts make you file a ticket for this, so check before you commit anywhere.
Set it on the IPv6 address too if your server sends over IPv6, because it will.
3. Four DNS records, all of them
| Record | Purpose | Skipping it means |
|---|---|---|
| MX | Where your mail is delivered | You receive nothing |
| SPF | Which servers may send as your domain | Mail marked as spoofed |
| DKIM | Signature proving the message is yours | Mail marked untrusted |
| DMARC | What to do when SPF or DKIM fails | No reports, weaker trust |
Our DNS records guide explains the syntax. Every mail platform generates its own DKIM key during setup, so that record comes from the software, not from you.
Start DMARC at p=none, which only asks for reports. Move to p=quarantine after a few weeks of clean reports.
4. Forward and reverse must agree
This is the check that fails most often. Your PTR must give a hostname, and that hostname must resolve back to the same IP.
$ dig -x 203.0.113.10 +short $ dig mail.example.com A +short
The first prints mail.example.com. The second prints 203.0.113.10. If they do not match, fix that before installing anything.
5. A valid TLS certificate
Mail between servers is encrypted opportunistically, and clients refuse plain connections. Every platform in our comparison can get a free certificate from Let's Encrypt automatically, so this is usually one checkbox.
6. IP reputation, which you cannot install
Your IP has no sending history. Receiving providers treat unknown IPs with suspicion, and there is no way to skip that period.
What actually helps:
- Send low volume at first and increase gradually over a few weeks.
- Send mail people asked for. Complaints damage reputation faster than volume builds it.
- Check your IP against blocklists before you start, using a public DNSBL checker.
- Set up DMARC reporting so you see rejections instead of guessing.
If you need to send bulk or transactional mail on day one, use a relay service for outgoing mail and keep your server for receiving. Plenty of people run it that way permanently.
Some networks will reject you regardless
A small number of large providers are slow to trust any new sending IP, whoever hosts it. If your business depends on inbox placement at one specific provider from day one, use a relay service for outgoing mail. Receiving your own mail has no such problem and works immediately.
7. Ongoing work
A mail server needs attention after it is running. Budget time for patching the software, reading DMARC reports, checking blocklists, and clearing the queue when a remote server has a bad day.
Quick reference
| Requirement | How to get it |
|---|---|
| Port 25 open | Ticket to us, before anything else |
| PTR record | Networking tab, self-service |
| MX, SPF, DMARC | Your DNS provider |
| DKIM | Generated by the mail software |
| TLS certificate | Automatic in every platform we cover |
| Reputation | Time and volume discipline |
Where to go next
If all seven apply and you still want to do it, our platform comparison covers what to install. If mail is already flowing and going to spam, start with our deliverability troubleshooting guide instead.