{"id":1674,"date":"2026-11-06T22:28:15","date_gmt":"2026-11-06T22:28:15","guid":{"rendered":"https:\/\/affordablevpsserver.com\/blog\/?p=1674"},"modified":"2026-11-06T22:28:15","modified_gmt":"2026-11-06T22:28:15","slug":"budget-vps-spf-dkim-dmarc-outbound-email","status":"publish","type":"post","link":"https:\/\/affordablevpsserver.com\/blog\/budget-vps-spf-dkim-dmarc-outbound-email\/","title":{"rendered":"Sending Outbound Email From a $5 VPS: SPF, DKIM, DMARC and the Port 25 Problem"},"content":{"rendered":"

Port 25 outbound is blocked on the overwhelming majority of budget VPS plans, and that single firewall rule decides whether your $5 server can send mail at all. Everything else — reverse DNS, SPF, DKIM, DMARC — is authentication that improves deliverability once the packets can leave. Get the port wrong and none of the DNS work matters.<\/p>\n

The configuration below is the reference sequence for a Debian or Ubuntu host running Postfix with OpenDKIM, sending transactional mail from a single domain. If you have not chosen the box yet, the <a href="affordable VPS hosting<\/a>“>budget VPS plan pages<\/a> list which providers allow port 25 on request, which is the first thing to verify before buying.<\/p>\n

The port 25 problem<\/h2>\n

Providers block outbound TCP 25 to stop spam and compromised accounts from burning the provider’s IP reputation. Many will unblock it on request, usually after manual review of a new account, sometimes only on a higher tier; several of the largest budget hosts never will. Check the policy before purchase, not after.<\/p>\n

Test what you actually have rather than trusting the FAQ. From the server, run nc -vz gmail-smtp-in.l.google.com 25<\/code> and then nc -vz smtp.gmail.com 587<\/code>. If 25 times out and 587 connects, you have an outbound block and a working route to a relay. Port 2525 is worth checking too; some hosts block 25 and leave it open for submissions.<\/p>\n

Reverse DNS and PTR before any DNS records<\/h2>\n

Most receiving servers check forward-confirmed reverse DNS. The PTR record for your IP must resolve to a hostname whose A record points back to the same IP. Set the PTR in the provider’s control panel to something like mail.example.com<\/code>, and make sure that name resolves to your server, not to a CDN or proxy.<\/p>\n

Send your HELO name as that same hostname. Mismatches between PTR, HELO and the banner are among the cheapest spam signals a receiver can evaluate. On a shared-IP plan the PTR may be under the provider’s control and set to their own hostname, which is a strong argument for a dedicated IP if you intend to send any volume.<\/p>\n

SPF: one record, ten lookups<\/h2>\n

SPF is a single TXT record at the apex of the sending domain. For a server whose only sender is your own IP, v=spf1 a mx ip4:203.0.113.10 -all<\/code> is usually enough. The -all<\/code> is a hard fail and is correct once every legitimate sender is listed; use ~all<\/code> only while you are still discovering senders.<\/p>\n

Two limits catch people. First, SPF has a hard limit of ten DNS lookups, and includes of large providers consume most of them. Second, a domain can have only one SPF record — two TXT records starting with v=spf1<\/code> is a permanent error at every receiver, not a merge. If you already send through a transactional provider, add its include to the existing record rather than creating a second one.<\/p>\n

DKIM with OpenDKIM<\/h2>\n

DKIM signs each message with a private key so the receiver can verify it was authorised by your domain and was not altered in transit. Install OpenDKIM, generate a 2048-bit key, and publish the public key as a TXT record at default._domainkey.example.com<\/code>. The selector, in this case default<\/code>, is arbitrary but must match on both sides.<\/p>\n

Wire it into Postfix with a milter socket, enable signing for your domain only, and verify with opendkim-testkey -d example.com -s default -vvv<\/code> before sending anything. Then send a message to a Gmail address and read the authentication results in the headers: look for dkim=pass<\/code> with your domain. A key that is published but not loaded into the milter produces a silent dkim=none<\/code>, which looks fine in your logs and fails at the receiver.<\/p>\n

DMARC: from p=none to p=quarantine<\/h2>\n

DMARC tells receivers what to do when a message fails both SPF alignment and DKIM alignment. Start at _dmarc.example.com TXT \"v=DMARC1; p=none; rua=mailto:dmarc@example.com; pct=100\"<\/code>. The aggregate reports that arrive daily are the whole point of this phase: they show every IP sending mail as your domain, including ones you forgot.<\/p>\n

After two to four weeks of clean reports, move to p=quarantine; pct=25<\/code> and raise pct<\/code> to 50 and then 100 over successive weeks. Only then go to p=reject<\/code>. Jumping straight to reject without report data is how legitimate invoices and password resets start disappearing, and the failure is silent from your side because the message left your server successfully.<\/p>\n

Shared IP reputation is not your reputation<\/h2>\n

On a shared address, your deliverability depends on every other tenant on that IP. One compromised account sending a spam run damages the address for everyone, and that history follows the IP long after the spam stops. Blocklist operators evaluate IPs and domains separately, and a clean new domain on a dirty IP fares badly.<\/p>\n

Ramping is the mitigation and a dedicated IP is the fix. Start with low volume — a few hundred messages a day — and increase gradually over a couple of weeks. Watch bounce and complaint rates, and check your IP against the common blocklists weekly during the ramp. Below a few thousand messages a month, shared IP with a good provider beats a dedicated IP with no sending history.<\/p>\n

When to relay through a smarthost instead<\/h2>\n

Relay when port 25 is blocked and will stay blocked, when your volume is too low to maintain a sending reputation, or when transactional mail is business-critical and you would rather pay someone to handle bounces and blocklisting. A smarthost routes mail through port 587 with credentials, so the block becomes irrelevant.<\/p>\n

Budget transactional relays start in the low single-digit dollars per thousand messages, which is usually cheaper than the hours you would spend on reputation management. Keep SPF and DKIM aligned to your own domain through the relay so authentication still points at you, and set the relay as Postfix’s relayhost<\/code> with SASL credentials in sasl_passwd<\/code>. Verify with a test to a Gmail address and confirm spf=pass<\/code> and dkim=pass<\/code> both reference your domain. If you are shopping for a host that unblocks port 25, <a href="affordable VPS plans<\/a>“>compare the current plans<\/a> and check the outbound-mail policy on each one before you order.<\/p>\n","protected":false},"excerpt":{"rendered":"

Port 25 outbound is blocked on the overwhelming majority of budget VPS plans, and that single firewall rule decides whether your $5 server can send mail at all. Everything else — reverse DNS, SPF, DKIM, DMARC — is authentication that improves deliverability once the packets can leave. Get the port wrong and none of the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":0,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1674","post","type-post","status-publish","format-standard","hentry","category-vps-deals-discounts"],"blocksy_meta":[],"yoast_head":"\nSending Outbound Email From a $5 VPS: SPF, DKIM, DMARC and the Port 25 Problem - Affordable VPS Server Blog<\/title>\n<meta name=\"description\" content=\"Port 25 outbound is blocked on the overwhelming majority of budget VPS plans, and that single firewall rule decides whether your $5 server can send mail\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/affordablevpsserver.com\/blog\/budget-vps-spf-dkim-dmarc-outbound-email\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Sending Outbound Email From a $5 VPS: SPF, DKIM, DMARC and the Port 25 Problem\" \/>\n<meta property=\"og:description\" content=\"Sending Outbound Email From a $5 VPS: SPF, DKIM, DMARC and the Port 25 Problem\" \/>\n<meta property=\"og:url\" content=\"https:\/\/affordablevpsserver.com\/blog\/budget-vps-spf-dkim-dmarc-outbound-email\/\" \/>\n<meta property=\"og:site_name\" content=\"Affordable VPS Server Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-06T22:28:15+00:00\" \/>\n<meta name=\"author\" content=\"Affordable-Vps-Server-Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Affordable-Vps-Server-Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/affordablevpsserver.com\/blog\/budget-vps-spf-dkim-dmarc-outbound-email\/\",\"url\":\"https:\/\/affordablevpsserver.com\/blog\/budget-vps-spf-dkim-dmarc-outbound-email\/\",\"name\":\"Sending Outbound Email From a $5 VPS: SPF, DKIM, DMARC and the Port 25 Problem - Affordable VPS Server Blog\",\"isPartOf\":{\"@id\":\"https:\/\/affordablevpsserver.com\/blog\/#website\"},\"datePublished\":\"2026-11-06T22:28:15+00:00\",\"author\":{\"@id\":\"https:\/\/affordablevpsserver.com\/blog\/#\/schema\/person\/685a02c93a3c45030f7427ec928b0df7\"},\"description\":\"Port 25 outbound is blocked on the overwhelming majority of budget VPS plans, and that single firewall rule decides whether your $5 server can send mail\",\"breadcrumb\":{\"@id\":\"https:\/\/affordablevpsserver.com\/blog\/budget-vps-spf-dkim-dmarc-outbound-email\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/affordablevpsserver.com\/blog\/budget-vps-spf-dkim-dmarc-outbound-email\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/affordablevpsserver.com\/blog\/budget-vps-spf-dkim-dmarc-outbound-email\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/affordablevpsserver.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Sending Outbound Email From a $5 VPS: SPF, DKIM, DMARC and the Port 25 Problem\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/affordablevpsserver.com\/blog\/#website\",\"url\":\"https:\/\/affordablevpsserver.com\/blog\/\",\"name\":\"Affordable VPS Server Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/affordablevpsserver.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/affordablevpsserver.com\/blog\/#\/schema\/person\/685a02c93a3c45030f7427ec928b0df7\",\"name\":\"Affordable-Vps-Server-Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/affordablevpsserver.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/8fa20973a7dd04621d396c26ba26b5c5e6c19595583335121958527393f6f95e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/8fa20973a7dd04621d396c26ba26b5c5e6c19595583335121958527393f6f95e?s=96&d=mm&r=g\",\"caption\":\"Affordable-Vps-Server-Author\"},\"sameAs\":[\"https:\/\/affordablevpsserver.com\/blog\"],\"url\":\"https:\/\/affordablevpsserver.com\/blog\/author\/affordablevpsserver\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Sending Outbound Email From a $5 VPS: SPF, DKIM, DMARC and the Port 25 Problem - Affordable VPS Server Blog","description":"Port 25 outbound is blocked on the overwhelming majority of budget VPS plans, and that single firewall rule decides whether your $5 server can send mail","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/affordablevpsserver.com\/blog\/budget-vps-spf-dkim-dmarc-outbound-email\/","og_locale":"en_US","og_type":"article","og_title":"Sending Outbound Email From a $5 VPS: SPF, DKIM, DMARC and the Port 25 Problem","og_description":"Sending Outbound Email From a $5 VPS: SPF, DKIM, DMARC and the Port 25 Problem","og_url":"https:\/\/affordablevpsserver.com\/blog\/budget-vps-spf-dkim-dmarc-outbound-email\/","og_site_name":"Affordable VPS Server Blog","article_published_time":"2026-11-06T22:28:15+00:00","author":"Affordable-Vps-Server-Author","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Affordable-Vps-Server-Author","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/affordablevpsserver.com\/blog\/budget-vps-spf-dkim-dmarc-outbound-email\/","url":"https:\/\/affordablevpsserver.com\/blog\/budget-vps-spf-dkim-dmarc-outbound-email\/","name":"Sending Outbound Email From a $5 VPS: SPF, DKIM, DMARC and the Port 25 Problem - Affordable VPS Server Blog","isPartOf":{"@id":"https:\/\/affordablevpsserver.com\/blog\/#website"},"datePublished":"2026-11-06T22:28:15+00:00","author":{"@id":"https:\/\/affordablevpsserver.com\/blog\/#\/schema\/person\/685a02c93a3c45030f7427ec928b0df7"},"description":"Port 25 outbound is blocked on the overwhelming majority of budget VPS plans, and that single firewall rule decides whether your $5 server can send mail","breadcrumb":{"@id":"https:\/\/affordablevpsserver.com\/blog\/budget-vps-spf-dkim-dmarc-outbound-email\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/affordablevpsserver.com\/blog\/budget-vps-spf-dkim-dmarc-outbound-email\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/affordablevpsserver.com\/blog\/budget-vps-spf-dkim-dmarc-outbound-email\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/affordablevpsserver.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Sending Outbound Email From a $5 VPS: SPF, DKIM, DMARC and the Port 25 Problem"}]},{"@type":"WebSite","@id":"https:\/\/affordablevpsserver.com\/blog\/#website","url":"https:\/\/affordablevpsserver.com\/blog\/","name":"Affordable VPS Server Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/affordablevpsserver.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/affordablevpsserver.com\/blog\/#\/schema\/person\/685a02c93a3c45030f7427ec928b0df7","name":"Affordable-Vps-Server-Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/affordablevpsserver.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/8fa20973a7dd04621d396c26ba26b5c5e6c19595583335121958527393f6f95e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8fa20973a7dd04621d396c26ba26b5c5e6c19595583335121958527393f6f95e?s=96&d=mm&r=g","caption":"Affordable-Vps-Server-Author"},"sameAs":["https:\/\/affordablevpsserver.com\/blog"],"url":"https:\/\/affordablevpsserver.com\/blog\/author\/affordablevpsserver\/"}]}},"_links":{"self":[{"href":"https:\/\/affordablevpsserver.com\/blog\/wp-json\/wp\/v2\/posts\/1674","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/affordablevpsserver.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/affordablevpsserver.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/affordablevpsserver.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/affordablevpsserver.com\/blog\/wp-json\/wp\/v2\/comments?post=1674"}],"version-history":[{"count":1,"href":"https:\/\/affordablevpsserver.com\/blog\/wp-json\/wp\/v2\/posts\/1674\/revisions"}],"predecessor-version":[{"id":1675,"href":"https:\/\/affordablevpsserver.com\/blog\/wp-json\/wp\/v2\/posts\/1674\/revisions\/1675"}],"wp:attachment":[{"href":"https:\/\/affordablevpsserver.com\/blog\/wp-json\/wp\/v2\/media?parent=1674"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/affordablevpsserver.com\/blog\/wp-json\/wp\/v2\/categories?post=1674"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/affordablevpsserver.com\/blog\/wp-json\/wp\/v2\/tags?post=1674"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}