Why these three blockers come before everything else
SPF, DKIM and DMARC are DNS records you control entirely. The three blockers covered here depend partly on your hosting provider and on the reputation of the IP you were assigned. Configuring DKIM is pointless if outbound port 25 is filtered at the hypervisor level: your server will attempt to deliver the message, will never reach the recipient's MX, and will log a connection error.
The resolution order is therefore: port 25 → IP reputation → PTR. Only once these three points are validated does authentication checking (SPF, DKIM, DMARC) make sense.
Blocker 1: outbound port 25 is closed by default
Most hosting providers block outbound port 25 on new accounts. This is not an oversight: it is a deliberate, documented, and liftable anti-spam measure.
Quick diagnosis from your VPS
- Test outbound connectivity to an external MX:
nc -zv gmail-smtp-in.l.google.com 25— "Connection refused" or a timeout indicates upstream filtering from your server - Also check with
telnet smtp.example.com 25: if the connection opens and you see the220banner, the port is open; otherwise, the block comes from the provider or an intermediate firewall - Distinguish a network block from an application refusal: an immediate
ECONNREFUSEDcomes from the provider firewall, a timeout from a local iptables rule or upstream BGP filtering
Unblocking procedure per provider
Hetzner
Hetzner blocks port 25 on all new projects. Unblocking is done via a support ticket from the Hetzner Cloud console ("Support" section). Observed conditions: verified account with an active credit card, legitimate use described (personal or business mail server, owned domain). The delay is typically 24 to 72 hours. Include in the ticket the IPv4 address of your instance, the domain you plan to use, and the estimated sending volume. Hetzner Robot (dedicated servers) follows the same procedure, opened from the "Support" tab of the Robot interface.
Scaleway
Scaleway offers an SMTP unblocking request form in the console, under "Security groups" or from the organization settings (depending on the interface version). You need to describe the use case and the sender domain. Processing is manual on Scaleway's side; the observed delay is one to three business days. Once validated, the unblocking applies at the security group level for your project — also verify that port 25 is not blocked in your own security group.
OVH / OVHcloud
On OVH Public Cloud (Nova instances), outbound port 25 may be filtered depending on the project type. The process goes through the OVH customer area, in the "Bare Metal Cloud" or "Public Cloud" section depending on your product. Look for the "Outbound anti-spam" option or open a ticket from the customer area specifying the instance type and intended use. On classic OVH VPS (SSD / Comfort / Elite range), port 25 is open by default but may be blocked if your account has triggered alerts.
Other providers
The principle is the same for most providers: unblocking is possible, conditional, and documented in their support base. Search for "SMTP port 25 unblock" or "outbound email policy" in their documentation. If the procedure is not public, a support ticket is sufficient — always specify the IP, domain and estimated volume.
Alternative ports: 587 and 465 do not replace port 25
Ports 587 (submission) and 465 (SMTPS) are used for email submission by mail clients to your own server. Server-to-server delivery (MTA-to-MTA) happens on port 25. If your VPS cannot open an outbound connection on port 25, you will not be able to deliver directly to recipient MX servers, regardless of how your other ports are configured.
Blocker 2: the reputation of a newly allocated IP
An IPv4 address allocated to your VPS is not blank. It may have belonged to a previous tenant who used it to send spam. Anti-spam filters at major mail providers (Gmail, Outlook, Yahoo) maintain blacklists of IP addresses — some are maintained by third-party organizations (Spamhaus, SORBS, Barracuda), others are proprietary.
A typical IP-related rejection looks like: 550 5.7.1 Service unavailable; Client host [x.x.x.x] blocked using Spamhaus. The mention of the blacklist organization tells you where to request removal.
Check your IP reputation before the first send
- Check multiple blacklist databases in one query via MXToolbox Blacklist Check: enter your IPv4 address and run the analysis
- For a command-line check,
curl -s "https://api.abuseipdb.com/api/v2/check?ipAddress=<your-ip>&maxAgeInDays=90" -H "Key: <your-key>"returns a confidence score and report history if you have an AbuseIPDB API key - If your IP is listed at Spamhaus (SBL, XBL, PBL), the removal procedure is documented on their site; the delay ranges from a few hours to 48 h
- If the IP is in the Barracuda Reputation Block List, removal is requested via their online form
- If no blacklist flags your IP but emails still land in spam, the problem comes from a missing PTR (blocker 3) or DNS authentication (SPF/DKIM/DMARC)
Progressive warm-up of a cold IP
Start with minimal volume
In the first few days, limit sends to a few dozen messages daily to known and engaged recipients (no purchased lists or mass sends). Filters will learn that your IP produces legitimate traffic.
Increase volume gradually
Roughly double the volume each week: 50 → 100 → 200 → 500 → 1,000 messages per day. This indicative schedule depends on your domain, your open rate and the absence of spam reports. A cold IP that immediately sends 10,000 messages will be filtered or blocked before its messages are even read.
Monitor deliverability metrics
Review DMARC reports (the rua field in your DMARC record) to detect rejections and blacklist returns. A hard bounce rate above 2% or a spam complaint rate above 0.1% should prompt you to pause and diagnose before resuming.
Use a score tool to validate the setup
mail-tester.com gives you a score out of 10 by analyzing headers, authentication, content and the sender IP reputation. Send a test message to the provided address and review the detailed report. Aim for 9/10 or above before launching your first production sends.
Blocker 3: the missing or mismatched PTR (rDNS)
The PTR (Pointer record, also called reverse DNS or rDNS) associates your IP address with a domain name. Unlike A or MX records that you create in your DNS manager, the PTR is configured on the provider side — they control the reverse DNS zone for their IP address block.
Receiving servers check the PTR at every incoming connection: if the IP address the message originates from does not resolve to a name, or if that name does not match the hostname announced in the HELO/EHLO of your MTA, the message is often rejected or heavily penalized.
PTR diagnosis in two commands
- Check the current PTR for your IP:
dig -x <your-ip> +short— if the command returns nothing, the PTR is not configured - Check consistency with your mail server hostname: the result of
dig -xshould match the name your MTA announces in theEHLO, which you can find in the Postfix configuration (myhostname), Stalwart or Mailcow - Do the reverse test:
dig <name-returned-by-dig-x> +shortshould return your IP — this is forward-confirmed rDNS (FCrDNS) validation, which some filters require
Configure the PTR from your provider panel
Hetzner Cloud
In the Hetzner Cloud console, go to your server, then to the "Networking" tab. Click on the IPv4 address, then on "Edit reverse DNS". Enter the fully qualified domain name (FQDN) that your MTA announces in the EHLO — for example mail.yourdomain.com. The change propagates within a few minutes.
Hetzner Robot (dedicated servers)
In the Hetzner Robot interface, go to the "Servers" section, choose your server, then the "IPs" tab. Click on the relevant IPv4 address and fill in the "PTR record" field with your FQDN.
Scaleway
In the Scaleway console, go to your instance, then to "IP addresses". Next to your IPv4 address, click the context menu and choose "Edit reverse DNS". Enter the FQDN of your mail server.
OVH / OVHcloud
In the OVH customer area, go to "Bare Metal Cloud" or "Public Cloud" depending on your product, then to the "IP" section. Locate your address and use the "Edit reverse" option. The expected format is a FQDN ending with a period in some interface versions — check the documentation for your customer area version.
Summary of the three blockers
| Blocker | Observed symptom | Resolution |
|---|---|---|
| Port 25 closed | Connection refused or timeout to remote MX, connection error in MTA logs | Provider support ticket, 24-72 h delay |
| Cold or blacklisted IP | 550 rejection mentioning a blacklist, delivery to spam from the first hours | Blacklist removal, progressive warm-up |
| Missing or mismatched PTR | 550 rejection mentioning reverse DNS, score penalty in anti-spam filters | Configuration from the provider panel |
Validate everything before going to production
nc -zv <target-mx> 25returnssucceeded— outbound port 25 is opendig -x <your-ip> +shortreturns the FQDN of your mail server — PTR is configured- That FQDN resolves to your IP via
dig <fqdn> +short— FCrDNS is valid - Your IP does not appear in any major blacklist checked via MXToolbox
- A test message sent to mail-tester.com scores 9/10 or above
- SPF, DKIM and DMARC records are in place and validated — see SPF, DKIM, DMARC: crossing the 5,000 email threshold for the detailed configuration
With a dedicated IPv4, you control the full chain
On shared hosting, you share the sending IP address with other customers — and their reputation affects yours without you being able to act on it. On a VPS with a dedicated IPv4, the PTR, the reputation and the email stack configuration are entirely yours. That is the technical condition that makes this guide possible.
