VPS email settings: rDNS, SPF, DKIM, DMARC

If you send email directly from your VPS (Postfix, Exim, Mailcow, a web app, etc.), you must set up the records below.

Outgoing email (SMTP, port 25) stays disabled on your VPS until all four items below are set up correctly.

Once all conditions are met, outgoing email is enabled automatically. You can check the current status in the Client Portal -> Networks page.

In the examples:

example.com - your domain
mail.example.com - your mail server's hostname
203.0.113.10 - your VPS IP address

1. A record and rDNS (PTR)

rDNS maps your IP back to a hostname. Receiving servers reject or spam-flag mail from IPs without a matching rDNS.

Create an A record at your DNS provider:
- Record type: A
- Hostname: mail
- Value: your VPS IP address, e.g. 203.0.113.10
Set the rDNS of your IP to mail.example.com in the Client Portal under your VPS.
Set the same hostname in your mail server as the HELO / EHLO name (e.g. Postfix: myhostname = mail.example.com).

All three must match: A record, rDNS and HELO hostname. If your VPS also sends over IPv6, set an AAAA record and IPv6 rDNS too.

2. SPF record

SPF lists which servers may send mail for your domain.

Record type: TXT
Hostname: @
Value: v=spf1 ip4:203.0.113.10 -all (replace 203.0.113.10 with your VPS IP address)
Using other services too (e.g. newsletters)? Combine them in one record:

v=spf1 ip4:203.0.113.10 include:other-service.com -all

Only one SPF record is allowed per domain. Two SPF records break both.

3. DKIM record

DKIM signs every outgoing message, so receivers can verify it was not forged or modified.

Generate a key pair on your mail server. Most panels (Mailcow, Plesk, cPanel, etc.) do this for you. With OpenDKIM:

opendkim-genkey -b 2048 -d example.com -s default
cat default.txt

Publish the public key:
- Record type: TXT
- Hostname: default._domainkey
- Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqh... (the content of default.txt)
Enable signing in your mail server with the private key (default.private).

Some DNS providers add extra quotation marks or backslashes to the value, remove them. Some ask only for default._domainkey as the hostname, without the domain.

Never share the private key. Only the public key goes into DNS.

4. DMARC record

DMARC tells receivers what to do with mail that fails SPF / DKIM.

Record type: TXT
Hostname: _dmarc
Value: v=DMARC1; p=none; sp=none; adkim=r; aspf=r;

p=none is a safe start: it does not affect delivery. Once everything passes, you can switch to p=quarantine or p=reject.

Checking

DNS changes may take a few minutes to a few hours to propagate.

dig +short -x 203.0.113.10
dig +short TXT example.com
dig +short TXT default._domainkey.example.com
dig +short TXT _dmarc.example.com

Send a test email to mail-tester.com - aim for a 10/10 score.

Notes

Using the VPS for spam or unsolicited bulk email is strictly prohibited. For more details, review the General Terms and Conditions.
New IPs have no sending reputation yet. Start with low volume.

VPS E-mail Settings