iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Most Linux VPS email failures are network-policy problems, not Postfix problems. The first thing to check is whether your provider permits outbound SMTP, especially TCP port 25. Many providers block port 25 (and some also block 465 or 587) to limit spam from compromised servers. If port 25 is blocked, use an authenticated SMTP relay on port 587 for application mail, or request an exception after your server identity and DNS records are ready. If the connection works but messages reach spam, investigate PTR, SPF, DKIM, DMARC, message headers and sender reputation separately.
What the failure looks like determines the fix
Start with the exact error instead of changing Postfix settings at random. A connection timeout, a refused connection, an authentication error and a recipient bounce occur at different layers.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Observed symptom | Likely layer | First check |
|---|---|---|
| Every delivery remains deferred and logs show a connection timeout | Provider, upstream network or firewall | Test TCP 25 to several recipient MX hosts; inspect local and cloud egress rules |
| Connection is refused immediately | Remote SMTP service, a firewall reject, or an incorrect destination | Verify the MX hostname and test more than one MX |
| Relay returns 535, 530 or similar authentication errors | SMTP submission credentials or authentication policy | Check the username, password, port and STARTTLS requirement |
| TLS handshake or certificate errors | Encryption mode, system clock, CA bundle or relay hostname | Confirm STARTTLS on 587 versus implicit TLS on 465 and inspect the TLS test output |
| Mail leaves the queue but is rejected with a 4xx or 5xx response | Recipient policy, sender identity or reputation | Read the complete SMTP response and examine SPF, DKIM, DMARC and PTR |
| Mail is accepted but appears in spam | Deliverability and reputation, not basic connectivity | Open the delivered message’s original headers and inspect Authentication-Results |
Why VPS providers restrict SMTP
Port 25 is the traditional server-to-server SMTP path. A self-hosted mail transfer agent uses it to connect directly to a recipient domain’s MX server. Providers restrict it because a compromised VPS can otherwise send large volumes of spam before the abuse is detected. cPanel describes the practice plainly: many providers block outbound port 25 to prevent spam from their networks.
Policies differ by product, location and account history. DigitalOcean’s support documentation, verified July 13, 2026, says SMTP ports 25, 465 and 587 are blocked on Droplets by default. OVHcloud states that port 25 is blocked by default on Public Cloud instances in a policy dated May 28, 2026, while documenting exceptions. These examples do not prove that every VPS provider blocks the same ports; check the policy for your exact service.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Port 587 is normally the authenticated submission port and is the usual choice for an application relay. Port 465 uses implicit TLS and is also used by some relays. Neither port is a universal replacement for direct server-to-server delivery: remote MX servers normally listen on port 25, not an arbitrary alternate port.
Diagnose the network path before changing Postfix
1. Read the queue and the mail log
On a Postfix host, inspect the queue and recent service messages:
Recommended Free Tools
postqueue -p
journalctl -u postfix -n 100 --no-pager
Depending on the distribution, the same information may be in /var/log/mail.log or /var/log/maillog. Copy the complete error for one queue ID with:
postcat -q QUEUE_IDDo not delete queued mail while diagnosing it. After the underlying problem is fixed, postqueue -f can request another delivery attempt. Removing a message with postsuper -d QUEUE_ID is irreversible, so use it only when you intentionally want to discard that message.
2. Find the recipient’s MX records
Test the actual destination selected by DNS, not a guessed hostname:
dig +short MX recipient.example
Resolve each returned MX hostname to A and AAAA records. A domain can publish several MX hosts, and one reachable host does not prove that the others are reachable.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute3. Test TCP 25 against several MX hosts
From the VPS, run a connection check for at least two recipient MX hosts:
nc -vz -w 10 mx1.example 25
nc -vz -w 10 mx2.example 25
A timeout to several unrelated MX providers strongly suggests a provider or upstream restriction, particularly when your Postfix log shows the same timeout. A refusal is different: a host actively rejected the connection, which can indicate a destination policy, a firewall reject or a wrong hostname. Test several MX records before drawing a conclusion.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
If netcat is unavailable, an equivalent TCP check is:
timeout 10 bash -c 'cat < /dev/null > /dev/tcp/mx1.example/25' && echo reachable || echo failedDo not treat a successful TCP handshake as proof that mail will be delivered. It only confirms that a socket can be opened.
4. Check both firewall layers
A local firewall can block egress even when the provider allows it. Inspect the rules actually in use:
sudo ufw status verbose
sudo nft list ruleset
sudo iptables -S
Then inspect the VPS control panel’s cloud firewall, security group and egress rules. Make sure outbound TCP 25 is allowed if you intend to deliver directly, and that outbound TCP 587 or 465 is allowed for a relay.
A local rule cannot remove a restriction enforced in the provider’s network. IONOS, for example, says its default port-25 block is controlled centrally rather than by the Cloud Panel firewall. If every local rule is permissive and several MX tests time out, open a provider support request instead of repeatedly editing UFW.
5. Rule out DNS and IPv6 surprises
Check that the VPS can resolve names and that its clock is correct. DNS failures appear as errors such as Temporary failure in name resolution or Host not found, not as SMTP rejections.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →If the server has an AAAA record but no usable IPv6 route, Postfix may try IPv6 first and defer delivery. Compare IPv4 and IPv6 connectivity explicitly. As a temporary diagnostic, you can set inet_protocols = ipv4 in Postfix and reload it; restore dual-stack operation once IPv6 is correctly routed and firewalled.
Choose direct delivery or an authenticated relay
| Axis | Direct delivery from the VPS | Authenticated SMTP relay |
|---|---|---|
| Network prerequisite | The provider must permit outbound TCP 25 and the destination MX must be reachable | Usually uses submission port 587; no port-25 exception is normally required |
| DNS and reputation work | You own the mail hostname, PTR, SPF, DKIM, DMARC, IP reputation and monitoring | The relay supplies the delivery infrastructure; you still publish the relay’s SPF and DKIM records and use an aligned sending domain |
| Operational effort | High: maintain the MTA, queues, abuse controls, blocklist monitoring and bounce handling | Lower for application notifications because the provider operates the delivery layer |
| Best fit | Mail operators who need server-to-server control and can manage reputation | Websites and applications sending password resets, receipts, alerts and other transactional mail |
DigitalOcean recommends a third-party email service when SMTP is blocked and warns that self-hosted delivery requires ongoing security and reputation work. For a web application that sends notifications rather than hosting mailboxes, a relay on 587 is usually the shortest reliable path.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Configure Postfix to use an SMTP relay on port 587
The exact relay hostname and DNS records come from the relay service you choose. The following sequence is the general Postfix pattern; replace the example values with the service’s documented values.
1. Create and verify the relay identity
- Create an account with the relay and verify the sending domain.
- Add the domain’s DKIM TXT record exactly as supplied by the relay.
- Add the relay’s SPF include to the domain’s existing SPF record. Keep one SPF TXT record for the domain rather than publishing several separate SPF records.
- Choose a From address on the verified domain and ensure your application uses that address consistently.
2. Set Postfix’s submission parameters
Edit /etc/postfix/main.cf and set the relay, authentication and encryption options. The CA-bundle path varies by distribution:
relayhost = [smtp.relay.example]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
Some relays require a different CA path or additional SASL settings. Use the relay’s hostname, not an IP address, so certificate validation can work correctly.
3. Store credentials with restrictive permissions
Create /etc/postfix/sasl_passwd with one line matching the relay host and port:
[smtp.relay.example]:587 USERNAME:PASSWORDProtect the file, create Postfix’s hashed map and reload the service:
sudo chmod 600 /etc/postfix/sasl_passwd
sudo postmap /etc/postfix/sasl_passwd
sudo systemctl reload postfix
Do not put relay credentials in application source code, a world-readable configuration file or a command copied into a public issue.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →4. Test STARTTLS and then send one controlled message
Port 587 normally begins as plain SMTP and upgrades with STARTTLS. You can inspect the handshake without sending credentials:
openssl s_client -starttls smtp -connect smtp.relay.example:587 -crlfLook for a certificate matching the relay hostname and a successful TLS negotiation. Then send a single test message from the application or with the local sendmail interface, and follow the queue and log:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
postqueue -p
journalctl -u postfix -f
If the relay returns an authentication error, verify that the account is enabled for SMTP submission, the password map contains the exact bracketed host and port, and Postfix was reloaded after running postmap. If TLS fails, check the system clock, CA bundle and whether the service expects implicit TLS on 465 instead of STARTTLS on 587.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsPrepare a VPS for direct server-to-server delivery
Request a port-25 exception only when you genuinely need direct delivery and are prepared to operate a mail server. Providers commonly ask for a stable identity and an explanation of the expected traffic.
Use a consistent forward and reverse identity
- Choose a fully qualified hostname such as
mail.example.com. - Create an A record pointing that hostname to the VPS’s public IPv4 address. If you will send over IPv6, publish a matching AAAA record and ensure the address is usable.
- Ask the VPS provider to set the sending IP’s PTR (reverse DNS) to the same mail hostname. Many providers control PTR themselves.
- Verify that the hostname in the PTR record resolves forward to the same sending IP.
Google’s Gmail sender guidance states: “The public IP address of a sending SMTP server must have a corresponding PTR record that resolves to a hostname.” The forward lookup must resolve back to that public IP; a PTR pointing to a hostname that does not resolve correctly is not an aligned identity.
Publish SPF, DKIM and DMARC
- SPF lists the servers authorized to send for your domain. Add the VPS address for direct delivery, or the relay’s include when using a relay.
- DKIM adds a cryptographic signature to each message. Generate a key in your MTA or obtain the selector and public key from the relay, then publish the public key as DNS.
- DMARC tells receiving systems how to handle messages that fail SPF or DKIM and provides reporting options. Start with a policy appropriate to your testing stage and tighten it after observing legitimate traffic.
Google recommends all three mechanisms. Cloudflare notes that missing SPF or DMARC can lead to rejection or inconsistent delivery. Authentication records must use the domain actually present in the message’s From address, with alignment as required by DMARC.
Request the exception with evidence of readiness
Give the provider your VPS identifier, public sending IP, mail hostname, PTR value, domain, expected volume, recipient regions and abuse contact. State that the server is not an open relay and that you will monitor queues, bounces and complaints. IONOS lists a valid FQDN, PTR and SPF as prerequisites for port-25 unblocking; PineRiver likewise requires an A record and aligned reverse DNS. Approval is provider-specific and can be denied or limited even when the DNS is correct.
Why mail can send successfully and still land in spam
An SMTP connection proves only that the receiving server accepted the transaction. It does not establish that the message is trustworthy. After delivery, open the original message headers and find the Authentication-Results field. For a healthy setup, check for spf=pass, dkim=pass and dmarc=pass, with the domains aligned to the visible sender where applicable.
Fix authentication failures before changing message wording. Confirm that SPF names the actual sender, that the DKIM signature survives any application or forwarding changes, and that DMARC alignment is correct. Also monitor bounces, complaint signals, sudden volume changes and the VPS IP’s reputation. A newly assigned or previously abused VPS address can have poor reputation even when every DNS record is valid.
Google’s requirements become stricter at scale: senders delivering more than 5,000 messages per day to personal Gmail accounts must meet its sender requirements, effective from 2024. That threshold is specifically for personal Gmail accounts and should not be generalized to every recipient provider or mailbox type.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Common failure branches and precise remedies
All MX tests time out
Confirm local and cloud egress rules, then ask the provider whether outbound 25 is blocked for the exact VPS product. If it is blocked, switch the application to an authenticated relay on 587 or submit an unblock request with the required identity records. Do not attempt to deliver directly to an MX on port 587; recipient MX servers generally do not provide that service.
Free tools Windows power users keep installed
One-click scans. No signup required.
Only one destination fails
Test the other MX hosts and inspect the destination’s complete SMTP response. A single recipient may have a temporary outage, a geoblocking rule or a policy targeting your IP. Keep the queue intact while the 4xx response is retried; investigate a 5xx response with the recipient administrator or correct your sender identity.
Postfix is running but the queue never drains
Check whether the queue entries are deferred for DNS, connection, TLS or policy reasons. A running daemon does not imply that it can reach an MX. Verify the route, the MX records and the provider’s egress policy, then run postqueue -f only after correcting the cause.
The relay accepts a connection but rejects login
Use the relay’s SMTP credentials rather than the VPS operating-system password. Check the exact host-and-port key in sasl_passwd, regenerate the map with postmap, reload Postfix and verify that the account is allowed to submit through SMTP. Never disable TLS merely to bypass an authentication error.
Messages work over IPv4 but not IPv6
Compare A and AAAA routes, firewall rules and PTR records. Either complete the IPv6 configuration, including reverse DNS, or temporarily set Postfix to IPv4 while you repair it. Leaving a broken AAAA path published can create intermittent, destination-dependent failures.
Delivery works but spam placement remains poor
Inspect Authentication-Results, verify DMARC alignment, check PTR forward resolution and review bounce and complaint rates. Correct identity and reputation problems rather than repeatedly flushing the queue; queue retries cannot improve a message that the recipient has already classified as suspicious.
Operational checklist before production sending
- Record the exact provider policy for ports 25, 465 and 587 for your VPS product and region.
- Test at least two unrelated recipient MX hosts from the VPS.
- Verify local firewall, cloud firewall and routing rules independently.
- Set a stable FQDN, forward DNS and provider-controlled PTR before requesting direct delivery.
- Publish one correct SPF record, DKIM and DMARC for the actual From domain.
- Use STARTTLS on 587 or the relay’s documented implicit-TLS mode on 465; do not send credentials over an unencrypted session.
- Protect credential files, keep Postfix patched and ensure the server cannot operate as an open relay.
- Monitor queue growth, deferred reasons, bounces, abuse notices and provider blocklist alerts.
- Inspect real delivered headers and confirm SPF, DKIM and DMARC results instead of relying only on a successful local send.
The practical decision
If TCP 25 times out to several unrelated MX hosts, treat the VPS provider or upstream network as the primary suspect. For a website or application that sends notifications, configure an authenticated relay on port 587 and publish its SPF and DKIM records. If you operate a full mail system and need direct server-to-server control, build the DNS identity first, secure the MTA, then request a provider exception and monitor reputation continuously. In either architecture, a successful SMTP connection is only the beginning: authenticated identity, correct reverse DNS and ongoing queue and reputation management determine whether messages actually arrive.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
