Want your VPS to send email, for example from your app, your website or your own mail server? Hoopla Hosting doesn't block port 25, inbound or outbound, on our network or upstream. If your email isn't getting through, the cause is almost always on the server itself, in your DNS records, or in how you're testing. This guide gives you a checklist to get email sending reliably and landing in inboxes rather than spam.

It works on every operating system we offer: Ubuntu 22.04, 24.04 and 26.04, Debian 12 and 13, AlmaLinux 8, 9 and 10, and Rocky Linux 9 and 10. The examples use Postfix, the most common mail server on Linux. If you use different mail software, the same checks apply.

Before you start

  • SSH access as root or as a user with sudo rights. If you're logged in as root, you can leave sudo off the commands.
  • A domain where you can add DNS records. Not sure where your DNS is managed? See Where is my DNS managed?
  • A hostname for your server, such as mail.example.co.nz.
  • A mail server installed, such as Postfix, or one of the all-in-one packages below.

Do you need your own mail server?

If your app or website only needs to send email, such as password resets, order confirmations or contact form messages, the simplest and most reliable option is an SMTP relay or transactional email service, such as Amazon SES, Postmark, Mailgun, SendGrid or Brevo. Your app logs in to the service on port 587, and the service looks after sending reputation, bounces and deliverability. You just add the SPF and DKIM records they give you to your DNS.

Running a full mail server, with mailboxes, webmail and incoming email, is real ongoing work. You'll need to keep it updated, filter spam, watch blacklists, back up mailboxes, and deal quickly with any account that gets compromised and starts sending spam. If you'd like to do it anyway, an all-in-one package sets most of it up for you:

  • mailcow: a complete mail server with webmail and spam filtering, running in Docker. Its documentation lists a minimum of 6 GB of RAM plus 1 GB of swap, so choose SURGE or larger. See the mailcow documentation.
  • Mail-in-a-Box: turns a fresh Ubuntu 22.04 server into a mail server, and sets up SPF, DKIM and DMARC for you. By default it wants to act as the nameserver for your domain, but you can use your own DNS instead. See the Mail-in-a-Box setup guide.

If you just need business email accounts, our cPanel web hosting includes email, and we look after the mail server for you.

A note about testing from home

Many home and office internet providers block outgoing connections to port 25 from their customers' connections, to stop infected computers sending spam. So if you test port 25 from your own computer, for example with telnet YOUR_SERVER_IP 25, and it times out, that doesn't mean your VPS is blocked. Run tests from the VPS itself, or use an online tool that connects from the internet (Step 7). Email apps on your computer should send through port 587 or 465 instead, which aren't normally blocked.

Step 1: Check your mail server is listening

sudo ss -tlnp | grep ':25'
  • 0.0.0.0:25 or [::]:25: your mail server is listening on all addresses, so it can receive email from the internet.
  • Only 127.0.0.1:25: it only accepts email from the server itself. That's fine if your VPS only sends, but to receive email it must listen on all addresses. On AlmaLinux and Rocky Linux, Postfix only listens locally by default. To change it: 
    sudo postconf -e 'inet_interfaces = all'
sudo systemctl restart postfix
  • No output: your mail server isn't running. Check it with sudo systemctl status postfix.

Step 2: Open the firewall

Port 25 is how other mail servers deliver email to you. If you run a full mail server, your email apps also need 587 (sending), 465 (sending over SSL) and 993 (IMAP).

Ubuntu/Debian with UFW enabled:

sudo ufw allow 25/tcp
sudo ufw allow 587/tcp
sudo ufw allow 465/tcp
sudo ufw allow 993/tcp

AlmaLinux/Rocky with firewalld:

sudo firewall-cmd --permanent --add-port=25/tcp --add-port=587/tcp --add-port=465/tcp --add-port=993/tcp
sudo firewall-cmd --reload

UFW and firewalld allow outgoing connections by default. If you've changed your firewall to block outgoing traffic, allow outgoing port 25 as well. Be careful not to block SSH. If you lock yourself out, log in with Open Console on your VPS's management page. See Use the web console to access your VPS.

If you use mailcow, it runs in Docker, which manages its own firewall rules. Follow the firewall advice in the mailcow documentation instead.

Step 3: Give your server a proper hostname

Your server's hostname should be a full domain name (FQDN), such as mail.example.co.nz, not localhost or a short name. Other mail servers see this name when your server connects to them.

sudo hostnamectl set-hostname mail.example.co.nz
hostnamectl

If you use Postfix, set the same name there:

sudo postconf -e 'myhostname = mail.example.co.nz'
sudo systemctl restart postfix

Step 4: Add an A record and set reverse DNS

Gmail, Yahoo and most other providers check that your server's IP address and hostname point to each other. This is one of the most common reasons email from a new VPS is rejected.

  1. In your domain's DNS, add an A record for mail.example.co.nz pointing to YOUR_SERVER_IP. If your DNS is in cPanel with us, see Manage DNS records with the Zone Editor.
  2. Set the reverse DNS (PTR) for your IP address in the client area. Go to Services → My Services, click Manage next to your VPS, then in the IP Assignments section click the entry in the RDNS column and set it to mail.example.co.nz. See Manage your VPS from the client area.
  3. Check both directions match. Install dig if you don't have it:

    Ubuntu/Debian

    sudo apt install -y bind9-dnsutils

    AlmaLinux/Rocky

    sudo dnf install -y bind-utils

    Then run:

    dig +short mail.example.co.nz
dig +short -x YOUR_SERVER_IP

    The first should show your IP address, and the second should show mail.example.co.nz. DNS changes can take a little while to show.

If your server also sends over IPv6, its IPv6 address needs matching reverse DNS too. If you can't set that up, tell Postfix to send over IPv4 only with sudo postconf -e 'inet_protocols = ipv4', then restart Postfix.

Step 5: Add MX, SPF, DKIM and DMARC records

For what each record does, see Emails going to spam: set up SPF, DKIM and DMARC. Add these records wherever your domain's DNS is managed, replacing the example values with your own.

MX record (only if your VPS receives email for the domain):

Name:     example.co.nz
Type:     MX
Priority: 10
Value:    mail.example.co.nz

An MX record must point to a hostname with an A record, never directly to an IP address.

SPF (a TXT record on the domain you send from):

Name:  example.co.nz
Type:  TXT
Value: v=spf1 mx ip4:YOUR_SERVER_IP ~all

A domain can only have one SPF record. If you also send through another service, such as Microsoft 365 or an SMTP relay, add its include: value to the same record.

DKIM (a TXT record with your public key):

Name:  selector._domainkey.example.co.nz
Type:  TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...

Your mail software creates the key and tells you the selector name and the full value to publish. With Postfix, OpenDKIM or Rspamd are common choices for DKIM signing. mailcow and Mail-in-a-Box set it up for you. Use a 2048-bit key if your software supports it.

DMARC:

Name:  _dmarc.example.co.nz
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc@example.co.nz

Start with p=none, which only collects reports. Once you're sure all your legitimate email passes, change it to p=quarantine or p=reject.

Step 6: Test sending from your VPS

First, check your VPS can connect to another provider's mail server. Look up Gmail's mail servers:

dig +short MX gmail.com

One of the results is gmail-smtp-in.l.google.com. Connect to it on port 25. You may need to install nc first, with sudo apt install -y netcat-openbsd on Ubuntu/Debian or sudo dnf install -y nmap-ncat on AlmaLinux/Rocky.

nc -v gmail-smtp-in.l.google.com 25

You should see a line starting with 220. Type QUIT and press Enter to close the connection. To check encryption works too:

openssl s_client -connect gmail-smtp-in.l.google.com:25 -starttls smtp

You'll see Google's certificate details. Press Ctrl+C to exit.

Next, send a real test email with swaks, a handy tool for testing mail servers:

Ubuntu/Debian

sudo apt install -y swaks

AlmaLinux/Rocky

sudo dnf install -y epel-release
sudo dnf install -y swaks

Then send a message through your own mail server to an address you can check:

swaks --to yourname@gmail.com --from test@example.co.nz --server localhost

Watch the mail log while you send, with sudo tail -f /var/log/mail.log (Ubuntu/Debian) or sudo tail -f /var/log/maillog (AlmaLinux/Rocky). If the file doesn't exist, use sudo journalctl -f. In Gmail, open the message and choose Show original. SPF, DKIM and DMARC should all show PASS.

Step 7: Test receiving from outside

Test incoming email from the internet, not from your home connection:

  • Send an email from a Gmail or Outlook.com account to an address on your server, and check it arrives.
  • Use the MXToolbox SMTP test. It connects to your server on port 25 and reports problems such as a reverse DNS mismatch or an open relay.
  • From another server, run swaks --to postmaster@example.co.nz --server mail.example.co.nz.

Step 8: Check deliverability and blacklists

  • mail-tester.com gives you an address to send a test email to, then scores it and lists anything to fix.
  • The MXToolbox Blacklist Check shows whether your IP address is on any common blacklists. If it is, fix the cause first, then follow that blacklist's removal process.
  • A new server has no sending reputation yet. Start with low volumes and build up gradually.

Gmail, Yahoo and Microsoft sender requirements

The big email providers publish rules that senders must meet. All senders to Gmail and Yahoo need:

  • SPF or DKIM (set up both).
  • Valid forward and reverse DNS for the sending IP address (Step 4).
  • Encrypted connections (TLS) for email sent to Gmail.
  • A spam complaint rate below 0.3%. Google recommends staying below 0.1%.
  • Correctly formatted messages.

Bulk senders, sending more than about 5,000 messages a day, also need:

  • SPF, DKIM and DMARC (at least p=none), with your From address's domain matching the SPF or DKIM domain. Microsoft has applied the same rule to Outlook.com, Hotmail and Live addresses since 5 May 2025.
  • One-click unsubscribe in marketing email, plus a visible unsubscribe link. Yahoo asks for unsubscribes to be honoured within 2 days.

Read the details in Google's email sender guidelines and Yahoo's sender best practices. For newsletters and marketing email, a dedicated email marketing service is usually a better choice than your own server.

Troubleshooting

  • Port 25 times out when you test from your own computer: your internet provider is probably blocking it. Test from the VPS itself (Step 6) or with an online tool (Step 7).
  • The nc test in Step 6 times out from your VPS: check your server's firewall isn't blocking outgoing connections, with sudo ufw status verbose or sudo firewall-cmd --list-all. If it still fails, open a support ticket and include the command and its output.
  • Gmail or another provider rejects your email and mentions PTR or reverse DNS: recheck Step 4. Both dig commands must match.
  • Email arrives locally but not from the internet: check the mail server listens on all addresses (Step 1), port 25 is open (Step 2), and your MX record is correct (Step 5).
  • Everything passes but email still goes to spam: your IP address is new or the content looks like spam. Check your mail-tester.com score, send smaller volumes for a while, and make sure people have asked to receive your email.

Related guides

Need help?

Our Cloud VPS plans are self-managed, so you're responsible for installing, securing and maintaining the software on your server. If something on our side isn't working, such as the network, or your VPS won't boot, open a support ticket. New to your VPS? Start with our Cloud VPS Getting Started Guide.

Was this answer helpful? 0 Users Found This Useful (0 Votes)

Most Popular Articles

Where are your servers located?

We run our VPS platform from two datacentres: Auckland, New Zealand: DataVault, in Grafton...
Cloud VPS Getting Started Guide

Welcome to your Hoopla Hosting Cloud VPS. This page is the best place to start. It explains...
Should I move to a VPS? Web hosting vs Managed cPanel VPS vs Cloud VPS

Most websites run happily on web hosting. But as a site gets busier, or you need software that...
Find your VPS login details and IP address

To connect to your new VPS, you need three things: its IP address, the username, and the...
Manage your VPS from the client area

Every Hoopla Hosting VPS comes with a management page in the client area. From there you can...