Why a shared hosting IP sabotages your emails
On a shared cPanel hosting, dozens — sometimes hundreds — of accounts coexist on the same IPv4. Each sends mail with that IP. The IP's reputation is shared: if a single account sends spam, is compromised, or exceeds a sending quota, the entire address range can be blacklisted.
Receivers like Gmail or Outlook evaluate the IP in the SMTP envelope. When that IP appears on a blacklist (Spamhaus, Barracuda, Invaluement…), all messages from it are rejected or relegated to spam. In SMTP terms, your client receives a 550 5.7.1 Message rejected or a 421 Try again later directly in the server logs.
For an agency managing a portfolio of sites, the exposure is proportional to the number of clients on the same IP pool. A poorly configured campaign from a neighbour penalises the entire estate — a structural fragility of shared hosting that a dedicated VPS SMTP relay eliminates entirely.
What you gain with a dedicated SMTP relay
- Clean, exclusive IPv4: you are the sole sender; you have complete control over the IP's reputation.
- DKIM signed at the source: every message carries a verifiable cryptographic signature, independent of the shared hosting infrastructure.
- Aligned SPF and DMARC: all three DNS records can point to your VPS, satisfying Google and Outlook's requirements for volumes above 5,000 emails per day.
- One relay for the entire estate: shared hosting sites, Laravel, Node.js and WordPress applications all send via
localhost:587on the VPS without changing any application logic. - Per-account SASL control: create a separate identity per client domain — if one account is compromised you revoke it without affecting others.
- Independence from third-party pricing: you step out of reliance on volume-billed SMTP relay providers whose pricing grids were revised upwards during 2025-2026.
- Full observability:
/var/log/mail.loggives you the exact trace of every send, bounce and rejection.
Architecture: relay-only, not a full MX server
It is important to distinguish two roles. A full MX server (such as Mailcow, covered in our dedicated article) manages mailboxes, inbound mail reception and a webmail interface.
An SMTP relay does one thing only: relay outbound sending. It receives no external mail, hosts no mailboxes, exposes no webmail interface. Postfix configured as relay-only listens only on localhost, accepts SASL-authenticated connections from local applications or authorised shared hosting servers, signs with OpenDKIM, and forwards to the final recipient.
This architecture has three practical advantages for an agency:
— Reduced attack surface: with no exposure on port 25 from the Internet, the risk of open relay or abuse is near zero.
— No mailbox management: your clients keep their Gmail, Microsoft 365 or cPanel Mail boxes unchanged.
— Deployment in under an hour: the procedure below is reproducible on any Linux VPS (Debian 12 / Ubuntu 22.04) by an administrator with intermediate system skills.
Prerequisites before you start
Verify these four points before starting the installation.
1. A VPS with at least 1 GB of RAM. Postfix and OpenDKIM are lightweight. A Start plan is more than enough for a portfolio of 20 to 50 client sites.
2. Port 587 open, never port 25. Cloud VPS operators block outbound port 25. Use port 587 (SMTP with STARTTLS and SASL authentication).
3. A PTR record configured on the VPS IPv4. Gmail and Outlook systematically verify this PTR and reject connections from IPs without a valid rDNS. Request its configuration from ServOrbit support.
4. A dedicated relay domain with DNS access. You will need to publish an SPF record and a DKIM TXT record on this domain.
Step-by-step installation and configuration
Install Postfix and OpenDKIM
Connect as root to your VPS, then run:
apt update && apt install -y postfix opendkim opendkim-tools swaks libsasl2-modulesDuring installation,
dpkg-reconfigure postfixoffers a wizard. Choose Internet Site and enter your relay hostname (relay.youragency.com).Configure /etc/postfix/main.cf
Replace the content of
/etc/postfix/main.cf:myhostname = relay.youragency.com mydomain = youragency.com myorigin = $mydomain inet_interfaces = all inet_protocols = ipv4 mydestination = relayhost = mynetworks = 127.0.0.1/32 [::1]/128 YOUR_SHARED_IP/32 smtp_use_tls = yes smtp_tls_security_level = may smtpd_use_tls = yes smtpd_tls_cert_file = /etc/letsencrypt/live/relay.youragency.com/fullchain.pem smtpd_tls_key_file = /etc/letsencrypt/live/relay.youragency.com/privkey.pem smtpd_sasl_auth_enable = yes smtpd_sasl_type = cyrus smtpd_sasl_path = smtpd smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, rejectGenerate and deploy DKIM keys with OpenDKIM
mkdir -p /etc/opendkim/keys/youragency.com opendkim-genkey -s mail -d youragency.com -b 2048 -D /etc/opendkim/keys/youragency.com/ chown -R opendkim:opendkim /etc/opendkim/keys/ chmod 700 /etc/opendkim/keys/youragency.com/Edit
/etc/opendkim.conf:Domain youragency.com KeyFile /etc/opendkim/keys/youragency.com/mail.private Selector mail Socket inet:12301@localhost UMask 002Connect Postfix to OpenDKIM via milter
Add to
/etc/postfix/main.cf:milter_protocol = 6 milter_default_action = accept smtpd_milters = inet:localhost:12301 non_smtpd_milters = inet:localhost:12301Restart both services:
systemctl enable --now opendkim systemctl restart postfixPublish the DNS records
Retrieve the DKIM public key:
cat /etc/opendkim/keys/youragency.com/mail.txtPublish SPF:
youragency.com IN TXT "v=spf1 ip4:YOUR_VPS_IP ~all"And DMARC:
_dmarc.youragency.com IN TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]; fo=1"Test the relay and validate the signature
swaks --to [email protected] --server localhost:587 \ --auth PLAIN --auth-user [email protected] \ --auth-password YOURPASSWORD \ --tlsCheck
/var/log/mail.logforstatus=sent. Send a message to[email protected]to validate DKIM alignment.Configure client sites to use the relay
Via cPanel / WHM: in WHM, *Exim Configuration Manager* → *Basic Editor* → *Outgoing Mail*, enable smart host pointing to your VPS IPv4, port 587.
Via Laravel
.env:MAIL_MAILER=smtp MAIL_HOST=VPS_IP MAIL_PORT=587 [email protected] MAIL_PASSWORD=YOURPASSWORD MAIL_ENCRYPTION=tlsVia WordPress / WooCommerce: install *WP Mail SMTP* or *Post SMTP* plugin with the same parameters.
Via Node.js / Nodemailer:
host: 'VPS_IP', port: 587, secure: false, auth: { user: '[email protected]', pass: 'YOURPASSWORD' }.
For a portfolio of more than 20 client sites, create a separate SASL account per client domain. If a client is compromised you revoke only their identifier without interrupting service for others. With OpenDKIM in SigningTable mode, each client domain can also sign with its own DKIM key — DMARC alignment becomes perfect for every sender in the portfolio.
Post-installation: monitor reputation and anticipate issues
Monitor /var/log/mail.log daily. Lines status=bounced or status=deferred deserve immediate attention: they contain the exact message from the remote server.
Subscribe to Google and Microsoft Postmaster Tools. Google Postmaster Tools gives you a domain and IP reputation dashboard, spam rate and delivery rate. Microsoft SNDS offers an equivalent view for Outlook.
Check blacklists at least once a week. MXToolbox Blacklist Check checks your IP against more than 100 lists in seconds.
Rate-limit per SASL account. Postfix's smtpd_client_message_rate_limit and anvil_rate_time_unit limit messages per time unit. A compromised account sending 10,000 emails in an hour will be blocked before it impacts your IP reputation.
Troubleshooting: the five most common errors
1. status=bounced (550 5.7.1) — IPv4 blacklisted or PTR missing. Check on mxtoolbox.com/blacklists.
2. DKIM=fail — verify: dig TXT mail._domainkey.youragency.com. Ensure the DNS value is on a single line.
3. Port 587 connection refused — ufw allow 587/tcp. Verify Postfix listens: ss -tlnp | grep :587.
4. Valid DKIM but still spam — DMARC alignment requires From: domain matches DKIM domain. Configure per-client DKIM selectors.
5. Silent mail.log — check systemctl status postfix. On some distributions, mail logs are in /var/log/syslog only.
A shared relay for the entire portfolio, a controlled reputation
In two hours of configuration, a Start VPS hosts a Postfix relay ready to route transactional mail for an entire client portfolio. The dedicated IPv4 stays under your exclusive control, the DKIM signature is verifiable, and both SPF and DMARC are aligned from first use.
Our article on SPF, DKIM and DMARC covers the DNS records in detail. If you also want to host your clients' mailboxes, our Mailcow guide describes setting up a full MX server on VPS.
