Sending Email from a VPS

Any server can technically send email. Getting that email delivered, and staying on the right side of the acceptable use policy while doing it, is the part that trips people up. This guide covers how outbound mail is handled on our network, the two ways to send reliably, and the DNS records that keep you out of the spam folder.

How outbound mail is handled#

To protect the reputation of the network's IP space, NoBull Networks reserves the right to apply outbound SMTP filtering by default. If your server has a legitimate need to deliver mail directly on port 25, open a ticket that says what the server sends (transactional notifications, a mailing list with confirmed opt-in, your own mailbox), roughly how much, and how you handle bounces and complaints. Requests are reviewed by an engineer and can be declined or revoked; sending unsolicited mail is a termination offence under the Terms of Service. The full policy is in Acceptable Use, Spam, and Abuse Reports.

Option 1: send through a relay (recommended)#

For application email (password resets, order confirmations, alerts) an SMTP relay service is the pragmatic answer: it handles reputation, retries, and feedback loops, and it works from any VPS without a port 25 exception because relays listen on 587 or 465. Postmark, Amazon SES, Mailgun, SendGrid, and Brevo are common choices; several have free tiers that cover a small site.

Point your application at the relay directly (most frameworks and WordPress SMTP plugins take host, port 587, username, password), or configure Postfix to relay everything so nothing on the server needs to know:

# /etc/postfix/main.cf
relayhost = [smtp.example-relay.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt

# /etc/postfix/sasl_passwd
[smtp.example-relay.com]:587 relay-username:relay-password

postmap /etc/postfix/sasl_passwd && chmod 600 /etc/postfix/sasl_passwd* && systemctl restart postfix

Option 2: run your own mail server#

Legitimate, and more work than it looks. Before the first message leaves, you need all of the following or receivers will refuse or junk it:

• A hostname that resolves to the server, and a matching reverse DNS (PTR) record.
• SPF (a TXT record listing your server as allowed to send for the domain), DKIM (a signing key published in DNS), and DMARC (a policy record). See Manage DNS Records for Your Domain.
• TLS on submission (587) and opportunistic TLS on 25; no open relay (test it).
• A port 25 exception if outbound filtering is applied to your server, requested as above.

Test with a service such as mail-tester before you rely on it, and watch bounces: a sudden spike is either a bad list or a compromised form.

Receiving mail on your VPS#

Inbound mail is unaffected by outbound filtering. Point the domain's MX record at your server, open port 25 inbound in your firewall, and run a receiving MTA and mailbox stack (Postfix plus Dovecot, or an all-in-one such as Mailcow or Mail-in-a-Box). If you only need to receive, a relay service or your domain registrar's forwarding may be simpler still.

Keep it clean#

Most spam from honest customers comes from a compromised contact form or an unpatched CMS. Keep web applications updated, rate-limit forms, and if you receive an abuse notice, respond in the ticket promptly; the process is in Recover from a Compromised Server.