Why your VPS cannot send email (and how to do it right)

Your website is up, the contact form is ready, but the emails do not leave. Or they leave and all land in spam. It is one of the most common problems on a VPS, and it almost always has a simple explanation.

Port 25 is blocked by default

Port 25 is the one mail servers use to talk to each other. It is also the favourite of anyone sending spam from compromised servers. To protect the reputation of the network, and therefore the delivery of every customer's email, outbound connections to port 25 are blocked by default on our servers. Almost every VPS provider does the same.

You can check it in a few seconds:

bash

nc -vz -w 5 smtp.gmail.com 25    # times out: the block is active
nc -vz -w 5 smtp.gmail.com 587   # answers: everything else works

The right fix: an SMTP relay

For contact forms, notifications, password resets and newsletters, the best way is to send through an SMTP provider on ports 587 (STARTTLS) or 465 (SSL/TLS), with a username and password. Configure your application, or Postfix, Exim or msmtp, to relay through it.

It is not just a way around the block: the provider's servers already have a good reputation, so your mail reaches the inbox far more often than when it leaves from a brand-new IP. If you have a web hosting plan, the mailboxes you create in its panel also work as an authenticated SMTP relay.

If you want your own mail server

It can be done, but it takes some preparation. Before asking for port 25 to be unblocked, set up:

a hostname that points to the server's IP, and the same name as reverse DNS (PTR) on that IP;
SPF and DKIM records for your domain, and a DMARC policy;
a server that only relays for authenticated users: no open relay.

Then ask for the unblock from the server's Firewall tab with Request unblock, or with a ticket: tell us what you will send, roughly how much, and how you prevent abuse. The unblock can be refused or revoked if the server sends spam, as our Terms provide.

Is your mail landing in spam?

It is almost always authentication or reputation:

check that SPF, DKIM and DMARC pass (send a message to a Gmail address and use Show original);
check that the reverse DNS matches the name the server introduces itself with;
check that the IP is not on a public blocklist;
with a new IP, start with low volumes: reputation is built over time.