A $5/month VPS with 1 vCPU, 1 GB RAM and 20 GB SSD is technically enough to run Postfix, Dovecot and a spam filter for a handful of mailboxes. CPU and disk are rarely the problem. The problem is that almost every budget provider blocks outbound TCP port 25 by default at the hypervisor’s network layer, and no amount of configuration inside the guest will change that.
Test before you commit. Open a shell on the VPS and run nc -zv gmail-smtp-in.l.google.com 25. A result of “Connection timed out” after roughly 30 seconds, while port 587 to the same host succeeds instantly, is the signature of an egress filter rather than a routing fault. On filtered networks the SYN is dropped silently rather than refused, which is why the failure takes so long to surface.
If you are still choosing a plan, read the terms of service before you read the specs. Many hosts list port 25 restrictions in an acceptable-use page rather than the product page, so comparing budget VPS plans with mail in mind means opening the AUP and searching for “SMTP”, “25” and “unsolicited”. A host that says nothing either way is usually blocking it.
Why budget hosts block port 25 in the first place
Cheap IP ranges are recycled aggressively. An address that hosted a spam botnet last month will be on several DNSBLs today, and the new tenant inherits that reputation the moment the VM boots. Providers respond by blocking 25 outbound across entire /24s to keep their ranges off uplink blacklists, because one bad tenant can get a whole block penalised with Spamhaus, which then damages every customer on it.
Some hosts will unblock 25 on request after a review that typically takes 1 to 7 days, and the review is manual. Expect to justify the domain, the sending volume and the opt-out process. Others never unblock and instead sell a dedicated IP as an add-on for $1 to $3 per month — but a dedicated IP does not bypass an egress filter, it only gives you an address with no prior reputation.
The PTR record problem nobody warns you about
Receiving servers increasingly reject or heavily score mail whose sending IP has no matching reverse DNS. On a budget VPS the PTR is either set through the provider’s control panel or not at all, and on some hosts it is locked to a generic pattern like static-1-2-3-4.provider.net with no self-service change. Check with dig -x YOUR.IP +short and confirm you can edit it before buying.
The forward and reverse names must agree. If your PTR resolves to mail.example.com, then mail.example.com must resolve to the same IP with an A record, and your HELO should announce that same name. A mismatch between HELO and PTR is one of the most common single-point penalties in spam scoring, and it costs nothing to fix once you have panel access to both zones.
SPF, DKIM and DMARC are table stakes, not a fix
Authentication records prove the message is legitimate; they do not make a reused IP range acceptable. Publish a strict SPF record with a hard fail, sign with DKIM at 2048-bit keys rotated every 6 months, and start DMARC at p=none with reporting enabled so you can see who is sending as your domain before you move to p=quarantine.
- SPF: single TXT record, ends in
-all, under 10 DNS lookups - DKIM: selector published, key at least 2048-bit, tested with a known-good sender
- DMARC:
ruareporting address active for at least 14 days before enforcement - MTA-STS and TLS-RPT: useful, worth adding after the basics are stable
Delisting is a process, not a support ticket
If your IP is already listed, identify every listing first with a multi-RBL lookup, because a request to one delisting form leaves the other four in place. Spamhaus, Barracuda, SpamCop and SORBS all have different forms and different response times. Barracuda typically clears within 12 to 48 hours; Spamhaus can take several days and wants evidence you have fixed the cause.
Delisting without fixing the source is wasted effort — the listing returns within hours. Send a test message to a Gmail and an Outlook mailbox, read the full authentication headers, and check whether your outbound volume spiked. A compromised mailbox or a contact form relayed to a foreign domain accounts for most sudden listings on small servers.
Warm-up thresholds that actually matter
A freshly unblocked IP has to earn volume. Starting at a few hundred messages a day and doubling every 3 to 4 days is slow, but sending 5,000 on day one will land you on a blocklist faster than any configuration error. Below is a realistic schedule for a small business mailbox cluster on a single VPS.
| Day | Daily messages | Watch |
|---|---|---|
| 1–3 | 100–200 | Bounce rate under 2% |
| 4–7 | 400–800 | Complaint rate under 0.1% |
| 8–14 | 1,500–3,000 | Deferral ratio under 5% |
| 15+ | Steady production | Reputation stable for 7 days |
When a relay is the sane answer
If port 25 is blocked and cannot be reopened, configure Postfix to hand all outbound mail to a smarthost on port 587 with SASL authentication. Transactional relay services price around $0.80 to $1.20 per 1,000 messages, and many have a free tier of 100 to 300 messages per day — often more mail than a five-person company sends.
In /etc/postfix/main.cf, set relayhost = [smtp.relay.example]:587, enable smtp_sasl_auth_enable = yes, point smtp_sasl_password_maps at a file mode 0600, and force TLS with smtp_tls_security_level = encrypt. Inbound mail on port 25 is a separate matter: check whether the host allows inbound 25 even when outbound is filtered, since many do.
What the $5 plan genuinely cannot do
Be honest about the ceiling. A single 1 GB VM running the MTA, IMAP server, ClamAV and SpamAssassin will swap under modest load; ClamAV alone wants 700 MB to 1 GB resident. Disable the antivirus and use rspamd with a small memory footprint, or accept that the box will thrash. Full-text search across 50 GB of mail on a 20 GB disk is simply not going to happen.
Choose hosting for mail by three measurable facts: whether outbound 25 can be enabled, whether the PTR is self-service, and whether the IP range has recent blocklist history. Everything else — CPU, disk, panel — is secondary. For workloads that fit those constraints, a small KVM instance with an external relay is a perfectly credible mail server; for anything larger, compare entry-level VPS configurations against the memory cost of modern spam filtering before you commit.
