Every few years, a new wave of developers decides to self-host their email. They install Postfix, spend two weeks fighting SPF/DKIM/DMARC records, get their IP blacklisted by Gmail, and switch back to Mailgun. This guide is for the realistic case.
Why It's Harder Than Expected
Residential/VPS IPs are pre-blacklisted: Mail providers (Gmail, Outlook, Yahoo) distrust VPS IPs by default because of historical spam. Your email often goes directly to spam folders regardless of content quality.
Reverse DNS is critical and often out of your control: Sending mail requires your VPS IP to have a PTR record (reverse DNS) matching your mail domain. Check this with your VPS provider - Space-Node can configure PTR records for VPS instances.
Maintenance burden: Mail servers need continuous attention - certificate renewals, spam filter updates, blacklist monitoring, bounce handling.
When It Makes Sense
Operational email for your own services: Sending automated emails (password resets, notifications, invoices) from your app via your own server is viable if you properly configure SPF/DKIM/DMARC.
Privacy-first use case: Hosting your own mailbox (Dovecot + Postfix + Roundcube) gives you full control over email storage and metadata. If this is your goal: worth doing.
Mail-in-a-Box: The Least Painful Path
Mail-in-a-Box automates the entire stack:
# Run on a fresh Ubuntu 22.04 VPS with dedicated IP
curl -s https://mailinabox.email/setup.sh | sudo bash
Sets up: Postfix, Dovecot, Roundcube, SpamAssassin, Let's Encrypt, SPF/DKIM/DMARC.
Essential DNS Records
# Required for deliverability:
yourdomain.com MX 10 mail.yourdomain.com
mail.yourdomain.com A YOUR_VPS_IP
# SPF: authorise your IP to send as @yourdomain.com
yourdomain.com TXT "v=spf1 ip4:YOUR_VPS_IP ~all"
# DKIM: cryptographic signature (key generated by your mail server)
mail._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=YOUR_KEY"
# DMARC: policy for handling failures
_dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; rua=mailto:postmaster@yourdomain.com"
The Honest Verdict
For sending transactional email (application notifications) at volume: use a relay service (Postmark, Mailgun, AWS SES). For private personal email: worth self-hosting. For a business email service you rely on: use Google Workspace or Fastmail.
Get a dedicated IP VPS for your mail server on Space-Node
The three things that actually decide deliverability
Before you touch Postfix, decide whether you can satisfy these:
- Reverse DNS (PTR) on the IPv4 must match HELO/banner.
- SPF, DKIM and DMARC must all pass for outgoing mail.
- Your IP must not be on Spamhaus/Spamcop/Barracuda RBLs.
Most cheap VPS IPs fail #1 or #3 out of the box. Always test before investing time.
Stack we recommend in 2026
| Function | Software | Reason |
|---|---|---|
| MTA | Postfix | mature, predictable |
| MDA / IMAP | Dovecot | Sieve filters, indexing |
| Spam | Rspamd (not SpamAssassin) | DKIM + DMARC + ML scoring in one |
| Web UI | Roundcube or SnappyMail | low-RAM webmail |
| ACME / TLS | acme.sh + Let's Encrypt | works without a web server |
Use Mailcow or Mailu if you don't want to wire it manually.
DNS records you need
mail.example.com. A YOUR.IP
example.com. MX 10 mail.example.com.
example.com. TXT "v=spf1 mx -all"
default._domainkey TXT "v=DKIM1; k=rsa; p=<rspamd public key>"
_dmarc TXT "v=DMARC1; p=quarantine; rua=mailto:postmaster@example.com"
p=quarantine first, move to p=reject after a week of clean reports.
What providers block silently
| Provider | Outgoing port 25 | Notes |
|---|---|---|
| Hetzner | open after request | small extra form |
| OVH | open by default | careful with spam reputation |
| Contabo | open by default | shared subnet, RBL risk |
| Oracle Free Tier | blocked | no work-around |
| AWS | blocked | request quota increase, slow |
| Google Cloud | blocked | not unblockable for free tier |
When to skip self-hosting
You should not run an MTA on a VPS if:
- You don't have time for ongoing reputation work (RBL responses, DMARC reports).
- Your subnet is shared with cheap VPS sellers.
- You need > 99.5 % delivery on transactional mail.
For transactional mail use a relay (Postmark, Amazon SES, Mailgun) and run your own IMAP only.
