Getting Self-Hosted Mail to Actually Deliver

Self-hosted mail has a reputation for being impossible. It is not impossible, it is just unforgiving. Almost every "it went to spam" story comes down to three or four specific things being wrong, and they are all checkable.

Port 25 is closed until you ask

Most providers block outbound port 25 on new accounts, because most people who want it are spammers. You ask for it, you explain what the machine is for, and you generally get it. Do that before you build anything else, because the whole plan depends on it and you will not find out it was refused until you try to send.

Reverse DNS, per address

A receiving server looks up the IP your mail came from and expects a name back, and it expects that name to resolve to the same IP. One missing record on one address in a pool means a slice of your mail is treated as suspicious for no reason you will easily see. If you are routing a whole subnet, every address you send from needs its own record, and you should check all of them rather than the first one.

The three DNS records, in order

SPF says which servers may send for your domain. DKIM signs the message so the receiver can tell it was not altered. DMARC tells the receiver what to do when the first two disagree, and, more usefully, asks for reports.

Set DMARC to p=none with a reporting address first, and actually read the reports for a few weeks. You will find services sending as your domain that nobody remembers setting up: a ticketing system, an old newsletter tool, somebody's contact form. Tighten to quarantine or reject only once that list is empty. Jumping straight to reject is how you discover your invoicing system was in that list.

Reputation is earned slowly

A new IP has no history, and sending a large campaign from it on day one is the single fastest way to be classified. Start small, send to people who actually opened your last mail, and grow over days. Keep bounce rates low and honour unsubscribes immediately, because complaint rate is the number that hurts most.

Give it a runbook

The part that gets skipped. Whoever runs this in six months needs to know how to check the queue, where the logs are, how to add a sending domain, what to do when a provider starts deferring, and who to contact about delisting. I write that document as part of the build, because the alternative is a system only I can operate, and that is not a system, it is a dependency.

Done in that order, self-hosted mail is boring, which is exactly what you want from mail.