Port 25 outbound is blocked on the overwhelming majority of budget VPS plans, and that single firewall rule decides whether your $5 server can send mail at all. Everything else — reverse DNS, SPF, DKIM, DMARC — is authentication that improves deliverability once the packets can leave. Get the port wrong and none of the DNS work matters.
The configuration below is the reference sequence for a Debian or Ubuntu host running Postfix with OpenDKIM, sending transactional mail from a single domain. If you have not chosen the box yet, the <a href="affordable VPS hosting“>budget VPS plan pages list which providers allow port 25 on request, which is the first thing to verify before buying.
The port 25 problem
Providers block outbound TCP 25 to stop spam and compromised accounts from burning the provider’s IP reputation. Many will unblock it on request, usually after manual review of a new account, sometimes only on a higher tier; several of the largest budget hosts never will. Check the policy before purchase, not after.
Test what you actually have rather than trusting the FAQ. From the server, run nc -vz gmail-smtp-in.l.google.com 25 and then nc -vz smtp.gmail.com 587. If 25 times out and 587 connects, you have an outbound block and a working route to a relay. Port 2525 is worth checking too; some hosts block 25 and leave it open for submissions.
Reverse DNS and PTR before any DNS records
Most receiving servers check forward-confirmed reverse DNS. The PTR record for your IP must resolve to a hostname whose A record points back to the same IP. Set the PTR in the provider’s control panel to something like mail.example.com, and make sure that name resolves to your server, not to a CDN or proxy.
Send your HELO name as that same hostname. Mismatches between PTR, HELO and the banner are among the cheapest spam signals a receiver can evaluate. On a shared-IP plan the PTR may be under the provider’s control and set to their own hostname, which is a strong argument for a dedicated IP if you intend to send any volume.
SPF: one record, ten lookups
SPF is a single TXT record at the apex of the sending domain. For a server whose only sender is your own IP, v=spf1 a mx ip4:203.0.113.10 -all is usually enough. The -all is a hard fail and is correct once every legitimate sender is listed; use ~all only while you are still discovering senders.
Two limits catch people. First, SPF has a hard limit of ten DNS lookups, and includes of large providers consume most of them. Second, a domain can have only one SPF record — two TXT records starting with v=spf1 is a permanent error at every receiver, not a merge. If you already send through a transactional provider, add its include to the existing record rather than creating a second one.
DKIM with OpenDKIM
DKIM signs each message with a private key so the receiver can verify it was authorised by your domain and was not altered in transit. Install OpenDKIM, generate a 2048-bit key, and publish the public key as a TXT record at default._domainkey.example.com. The selector, in this case default, is arbitrary but must match on both sides.
Wire it into Postfix with a milter socket, enable signing for your domain only, and verify with opendkim-testkey -d example.com -s default -vvv before sending anything. Then send a message to a Gmail address and read the authentication results in the headers: look for dkim=pass with your domain. A key that is published but not loaded into the milter produces a silent dkim=none, which looks fine in your logs and fails at the receiver.
DMARC: from p=none to p=quarantine
DMARC tells receivers what to do when a message fails both SPF alignment and DKIM alignment. Start at _dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]; pct=100". The aggregate reports that arrive daily are the whole point of this phase: they show every IP sending mail as your domain, including ones you forgot.
After two to four weeks of clean reports, move to p=quarantine; pct=25 and raise pct to 50 and then 100 over successive weeks. Only then go to p=reject. Jumping straight to reject without report data is how legitimate invoices and password resets start disappearing, and the failure is silent from your side because the message left your server successfully.
Shared IP reputation is not your reputation
On a shared address, your deliverability depends on every other tenant on that IP. One compromised account sending a spam run damages the address for everyone, and that history follows the IP long after the spam stops. Blocklist operators evaluate IPs and domains separately, and a clean new domain on a dirty IP fares badly.
Ramping is the mitigation and a dedicated IP is the fix. Start with low volume — a few hundred messages a day — and increase gradually over a couple of weeks. Watch bounce and complaint rates, and check your IP against the common blocklists weekly during the ramp. Below a few thousand messages a month, shared IP with a good provider beats a dedicated IP with no sending history.
When to relay through a smarthost instead
Relay when port 25 is blocked and will stay blocked, when your volume is too low to maintain a sending reputation, or when transactional mail is business-critical and you would rather pay someone to handle bounces and blocklisting. A smarthost routes mail through port 587 with credentials, so the block becomes irrelevant.
Budget transactional relays start in the low single-digit dollars per thousand messages, which is usually cheaper than the hours you would spend on reputation management. Keep SPF and DKIM aligned to your own domain through the relay so authentication still points at you, and set the relay as Postfix’s relayhost with SASL credentials in sasl_passwd. Verify with a test to a Gmail address and confirm spf=pass and dkim=pass both reference your domain. If you are shopping for a host that unblocks port 25, <a href="affordable VPS plans“>compare the current plans and check the outbound-mail policy on each one before you order.
Related Articles：
How to Evaluate VPS Renewal Prices: Avoiding the 200-300% Price Hike After Year One
How to Save 50% on Your First Year of VPS Hosting: Promo Codes, Free Credits, and Renewal Strategies
Egress Bandwidth Cost Traps on Small VPS Plans: A Practical Survival Guide
RAM per Dollar Is a Broken Metric: What the $5, $10 and $20 Tiers Really Deliver
