Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
A dependable mail server on a Linux VPS is a chain of systems, not a single package: a stable IP and hostname, Postfix for SMTP, Dovecot for mailbox access, authoritative DNS, TLS, SPF/DKIM/DMARC, strict relay controls, and continuous monitoring. Build and test each layer in that order. If any layer is missing, messages may be rejected, deferred, or delivered to spam even when Postfix appears to be running.
What a VPS mail server must provide
A typical installation has two distinct mail flows. Postfix accepts mail from other servers on TCP port 25 and delivers outgoing mail to recipient servers. It also accepts authenticated mail submissions from your users, normally on port 587 (or 465 for implicit TLS). Dovecot provides IMAP or POP3 access to stored messages and can authenticate users for Postfix. Local delivery connects Postfix to Dovecot so that submitted and received mail reaches the correct mailbox.
DNS tells the rest of the internet that your server is legitimate. TLS encrypts SMTP and mailbox sessions and proves the server identity. SPF, DKIM and DMARC publish the domains and keys that receivers use to authenticate your messages. Firewall rules, service accounts, updates, backups and logs keep the system from becoming an open relay or an easy target.
- Infrastructure identity: a static public IPv4 address, a stable hostname and provider-controlled reverse DNS (PTR).
- SMTP transport: Postfix listening on port 25 for server-to-server traffic and on a submission service for authenticated clients.
- Mailbox access: Dovecot IMAP, usually on 993 with TLS, with POP3 only when a documented requirement exists.
- Trust signals: forward DNS, reverse DNS, a trusted certificate, SPF, DKIM and DMARC.
- Operations: firewalling, patching, queue and log review, backups, abuse controls and reputation monitoring.
Prerequisites to verify before installing anything
Choose a mail-permitted VPS
Ask the provider whether outbound TCP port 25 is allowed and whether you can set a PTR (also called reverse DNS or rDNS) for the public IPv4 address. A fixed address is essential; a changing address invalidates DNS and damages reputation. Shared, recently recycled or residential-looking ranges are more likely to have a poor history. Confirm that the provider will keep the address assigned for the life of the server and that abuse complaints are handled promptly.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Control the domain’s DNS
You need authority to create A, AAAA, MX, TXT and DKIM records. Decide on a dedicated mail hostname such as mail.example.com. The hostname should resolve to the VPS address, and the address’s PTR should resolve back to that same hostname. Do not add an AAAA record unless IPv6 is configured, firewalled and reputation-ready; an unreachable IPv6 path can cause intermittent delivery failures.
Reserve the required ports
| Port | Purpose | Exposure |
|---|---|---|
| 25/TCP | SMTP between mail servers | Public, but never an unauthenticated relay |
| 587/TCP | Authenticated message submission with STARTTLS | Public for users and applications |
| 465/TCP | Authenticated submission with implicit TLS | Optional when clients require it |
| 993/TCP | IMAP over implicit TLS | Public for mailbox clients |
| 995/TCP | POP3 over implicit TLS | Only if POP3 is needed |
Keep administrative services such as SSH restricted to trusted source addresses or a VPN. Do not expose Dovecot’s unencrypted IMAP or POP3 ports to the internet.
Set forward and reverse DNS first
- Set the VPS hostname to the fully qualified name, for example
mail.example.com. On a systemd Linux distribution, verify it withhostnamectl statusand set it withsudo hostnamectl set-hostname mail.example.com. - Create an A record for
mail.example.compointing to the VPS IPv4 address. Create an AAAA record only for a working IPv6 address. - Set the provider’s PTR/rDNS value for the IPv4 address to
mail.example.com. If IPv6 will send mail, set its PTR as well. - Check both directions from an independent network:
dig +short A mail.example.comanddig +short -x 203.0.113.10. The first must return the sending address and the second must return the exact hostname. - Use the same hostname in Postfix’s
myhostname, in the TLS certificate, and in the SMTP greeting. Wait for DNS propagation before testing delivery.
Google’s Gmail sender guidelines explicitly require that a sending SMTP server’s public IP have a corresponding PTR record resolving to a hostname. Gmail also checks valid forward DNS, so a one-way or mismatched setup is not sufficient.
Install Postfix and Dovecot with a clear role split
Distribution packages
Use your distribution’s signed packages so security updates integrate with the operating system. On Debian or Ubuntu, a minimal starting point is:
sudo apt update
sudo apt install postfix dovecot-imapd dovecot-core
During the Postfix prompt, choose an internet-site configuration and enter the mail hostname. On Red Hat Enterprise Linux and compatible distributions, install the Postfix and Dovecot packages with the distribution package manager and enable them through systemd. Package names and configuration paths vary by release; keep the vendor defaults under version control before editing.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Postfix identity and local domains
Set myhostname to the FQDN that has matching DNS and PTR. Define only the domains for which this server is authoritative in mydestination or the appropriate virtual-mailbox maps. A server that treats arbitrary destination domains as local will either lose mail or become an abuse target.
Choose a mailbox model early. System users are simple for a small, trusted installation. Virtual mailboxes isolate mail accounts from operating-system logins and scale better, but require maps, ownership and quota planning. Whichever model you choose, make Postfix’s local-delivery transport hand mail to Dovecot’s LMTP service where possible; Red Hat’s mail-server guidance documents this integration as a way to reduce network exposure and keep delivery authentication in one place.
Dovecot mailbox access
Enable IMAP over TLS on 993. Disable plaintext authentication unless it is protected by TLS, and disable POP3 entirely when no client needs it. Configure a dedicated mail user or virtual-mailbox account with the least privileges needed to read and deliver mail. Test that a mailbox user cannot read another user’s files and that the Dovecot service cannot write outside its mail storage.
Obtain and deploy a trusted TLS certificate
Get a publicly trusted certificate whose name includes the mail hostname. Postfix’s TLS documentation states that modern TLS operation requires a certificate and private key; its documentation also notes that running without certificates would require disabling TLS 1.3, which is not an acceptable production workaround. Use an automated certificate authority and renewal process, then verify that renewal reloads both services before the old certificate expires.
- Request a certificate for
mail.example.comusing a method that can complete validation from your DNS or web infrastructure. - Store the private key readable only by root and the service account that genuinely needs it. Keep the full certificate chain available to clients.
- Point Postfix’s certificate, private-key and chain settings at those files. Configure Dovecot’s
ssl_certandssl_keyto use the same certificate and key. - Set Postfix server-side TLS, protocol and cipher policies according to the current distribution guidance. Ubuntu’s Postfix guide specifically covers
smtp_tls_security_level,smtpd_tls_security_level, TLS logging, hostname settings and certificate-chain files. - Reload after every change and inspect the service status. Test from another host with an SMTP and IMAP TLS client; confirm the certificate name, chain and negotiated protocol.
Do not advertise a certificate for a name that clients never use, and do not copy private keys into world-readable configuration backups.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Separate submission from public SMTP reception
Port 25: server-to-server only
Port 25 must accept unauthenticated mail addressed to domains hosted on your server and deliver outbound mail to other servers. It must reject relay attempts for unrelated destinations. In Postfix, relay permission should depend on authenticated users, trusted networks and valid recipient domains—not merely on a client reaching port 25.
Port 587 (and optional 465): authenticated users
Require SMTP AUTH on the submission service and require TLS before accepting credentials. Use a separate submission policy: authenticated clients may relay to external domains, while unauthenticated internet clients may not. Port 465 uses implicit TLS; enable it only when your client population needs it. Never send passwords over plaintext connections.
Prove that relay is closed
- From an external network, attempt to send from an untrusted address to an unrelated destination without authenticating. It must be rejected.
- Authenticate on 587, send to a controlled external mailbox, and confirm the message is queued and delivered.
- Check the Postfix log for the authenticated username, queue ID, recipient and final status.
- Review the queue after testing; remove test messages and investigate any unexpected deferred or bounced mail.
Publish SPF, DKIM and DMARC correctly
SPF
Publish one SPF TXT record at the envelope-sender domain. Authorize the VPS’s sending IP and every other legitimate sender, then end with an explicit policy such as -all only after the complete sender inventory is known. Multiple SPF records are invalid; combine mechanisms in a single record and stay within SPF’s DNS-lookup limit.
DKIM
Install a DKIM signer that creates a per-domain, per-selector key pair. Publish the public key at selector._domainkey.example.com and keep the private key outside the web root with restrictive permissions. Google requires at least a 1,024-bit DKIM key for personal Gmail delivery and recommends 2,048 bits when supported. Rotate selectors periodically and retain the old public key until all messages signed with it have expired from receivers’ verification windows.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →DMARC alignment
Start with a monitoring policy such as p=none, include a reporting address, and review aggregate reports for every legitimate source. Then move to quarantine or reject after fixing failures. For direct mail, Google says the visible From domain must align with either the SPF domain or the DKIM signing domain. A message can pass SPF yet fail DMARC if the authenticated envelope domain does not align with the address users see.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Use a DMARC record that identifies the policy, reporting address and alignment choices; document who receives reports and how long they are retained. Do not tighten enforcement while a newsletter, help-desk system or application is still sending with an unrecognized path.
Apply firewall and host hardening
- Allow only 25, 587, optional 465, 993 and any deliberately enabled 995 from the public internet.
- Restrict SSH to administration addresses, use key authentication and disable password login where operationally safe.
- Install unattended security updates or a scheduled patch process, but stage major Postfix and Dovecot upgrades and verify configuration syntax afterward.
- Run Postfix and Dovecot with their packaged least-privilege accounts. Do not grant broad shell or filesystem access to mailbox users.
- Use rate limits, account lockout or fail2ban-style controls for repeated authentication failures, balancing them against shared NAT users.
- Back up mail data, configuration, DKIM keys, virtual-user maps, TLS renewal state and DNS records. Encrypt backups and perform a documented restore test.
Log retention must cover at least the period in which a delivery complaint, account takeover or queue spike could be investigated. Protect logs from unauthorized mailbox users and forward a copy to separate storage when possible.
Test the complete path before production
- DNS: verify A/AAAA, PTR, MX, SPF, DKIM and DMARC from outside the VPS network. Confirm that forward and reverse names agree exactly.
- TLS: connect to SMTP submission and IMAPS from an independent host. Confirm the certificate chain, hostname and protocol; ensure plaintext authentication is refused.
- Authentication: log in with a test mailbox on IMAP and SMTP AUTH. Verify an incorrect password is rejected and that credentials are not logged.
- Local delivery: send between two local mailboxes and confirm the message arrives through Dovecot without permission errors.
- Remote delivery: send to controlled addresses at several recipient networks. Inspect authentication results, headers, TLS use, delivery time and spam placement.
- Inbound delivery: send from an unrelated provider to your hosted domain. Confirm MX routing, recipient validation and mailbox storage.
- Failure handling: stop a test destination or use an invalid recipient, then inspect the deferred queue, retry timing and eventual bounce. Restore service and confirm the queue drains.
- Abuse resistance: repeat an unauthenticated relay test from outside the trusted network. The server must refuse it and produce a clear log entry.
Monitor delivery, reputation and security
Inspect logs and queues daily
Track accepted, delivered, deferred and bounced messages; queue age; authentication failures; unexpected volume by account; and repeated connections from the same networks. A growing deferred queue usually indicates DNS, remote-policy, TLS or reputation trouble rather than a Postfix process failure. Examine the queue ID across Postfix and Dovecot logs to follow one message end to end.
Watch Gmail’s sender requirements
Google’s current guidance requires all senders to use SPF or DKIM, valid forward and reverse DNS, TLS and RFC 5322-compliant message formatting. Google also states that senders should keep the spam rate below 0.3%. Senders transmitting more than 5,000 messages to Gmail in a 24-hour period must use SPF, DKIM and DMARC. The 5,000-message figure is a daily threshold, not a safe operating target; a smaller sender can still be filtered for complaints or poor reputation.
Register the domain in Gmail Postmaster Tools when eligible. Review authentication, reputation, delivery errors, spam-rate and complaint indicators, and correlate changes with queue volume, content changes or a compromised account. Compliance improves the chance of acceptance but never guarantees inbox placement; receivers also evaluate reputation, complaints, message content and their own policies.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Respond to incidents
- Sudden outbound spike: disable or reset the affected account, inspect authenticated sessions, preserve logs, remove the queue abuse and rotate exposed credentials.
- Repeated deferrals: check the remote response, DNS and PTR, TLS negotiation, recipient validity and whether the sending IP is listed or has a poor reputation.
- DMARC failures: identify the sending source from aggregate reports, correct SPF or DKIM alignment and leave enforcement at monitoring until legitimate traffic passes.
- Certificate warning: verify renewal, file permissions, chain configuration and that Postfix/Dovecot were reloaded after renewal.
Choose an implementation model deliberately
| Decision | Advantages | Costs and risks | Best fit |
|---|---|---|---|
| Self-managed Postfix/Dovecot | Maximum control, privacy and configuration flexibility | You own patching, abuse response, reputation and deliverability | Operators comfortable with Linux mail administration |
| Hosted relay | Provider-assisted reputation, queueing and outbound scaling | Less control over data path, policy and account limits | Teams that need reliable outbound delivery without operating SMTP reputation |
| Distribution packages | Native upgrades, service integration and familiar troubleshooting | Version differences and manual integration work | Conventional single-purpose VPS deployments |
| Containerized mail suite | Isolation and bundled automation | More moving parts, persistent-volume and upgrade complexity | Teams with container operations experience |
| Single server | Low cost and simple topology | One failure affects SMTP and mailbox access | Small installations with tested backups |
| Separated roles | Fault isolation and independent scaling | More DNS, TLS, monitoring and synchronization work | Growing or higher-availability environments |
Direct-to-recipient SMTP gives infrastructure control but makes your IP reputation and queue behavior entirely your responsibility. An authenticated relay shifts some of that operational burden while adding a provider dependency. Neither model removes the need for correct domains, authentication and monitoring.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Common failure modes and precise fixes
Mail is rejected immediately
Read the remote SMTP response instead of guessing. Check that the connecting IP has a PTR, the PTR hostname has an A record, the certificate name matches, port 25 is not blocked, and SPF/DKIM authentication is present. Correct one failure at a time and retest from a clean queue.
Messages are accepted but land in spam
Verify DMARC alignment, DKIM signatures, the SPF result and the visible From domain. Review the spam rate and complaints in receiver tools, reduce unsolicited volume, remove invalid addresses and investigate compromised accounts. Technical compliance cannot compensate for unwanted mail or a damaged IP reputation.
Users can send but cannot receive
Check the MX record and inbound port 25, then follow the queue ID through Postfix local delivery and Dovecot LMTP or mailbox permissions. Confirm that the recipient domain is configured as local and that disk space and quotas are available.
IMAP works intermittently
Look for expired certificates, an incorrect AAAA record, firewall connection limits, exhausted file descriptors or overloaded storage. Remove an unusable IPv6 record rather than allowing clients and senders to select a broken path.
Free tools Windows power users keep installed
One-click scans. No signup required.
When a VPS is the wrong choice
Use a hosted mailbox or relay instead when you cannot obtain a stable IP and PTR, cannot staff abuse and patch response, need provider-level redundancy, or send volumes that exceed what your reputation program can support. A VPS is appropriate only when you can operate every layer from DNS through incident response; installing Postfix alone is not a deliverability strategy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
