[{"data":1,"prerenderedAt":134},["ShallowReactive",2],{"seo-verification":3,"blog-postfix-smtp-relay-on-vps-client-transactional-emails-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":23,"featuredImage":25,"bgImage":26,"posterImage":27,"relatedSolution":25,"intro":28,"sections":29,"ctaTitle":88,"ctaBody":89,"ctaButton":90,"ctaUrl":91,"relatedPosts":92},280,"postfix-smtp-relay-on-vps-client-transactional-emails",{"fr":10,"en":8,"ar":11},"smtp-relay-vps-emails-transactionnels-clients","إعداد-postfix-smtp-relay-على-vps-لبريد-المواقع","Postfix SMTP Relay on VPS: Client Transactional Emails","Set up Postfix as an SMTP relay on a ServOrbit VPS: dedicated IPv4, SPF, DKIM and DMARC aligned for your entire cPanel client portfolio in under an hour.",10,0,false,"2026-08-18T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},11,"Business Email","emails","bg-cyan-500\u002F10 text-cyan-400",[24],{"id":19,"name":20,"slug":21,"color":22,"icon":21},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fsmtp-relay-vps-emails-transactionnels-clients-poster.svg","A client domain lands in spam or their order confirmations stop arriving — more often than not the culprit is not the message content but the sending IP: a shared hosting IP used by dozens of other accounts. Configuring Postfix as an SMTP relay on a dedicated VPS solves this at the root, for your entire client portfolio, with a single clean IPv4 whose reputation you fully control.",[30,34,45,48,51,76,79,82,85],{"type":31,"title":32,"body":33},"h2","Why a shared hosting IP sabotages your emails","On a shared cPanel hosting, dozens — sometimes hundreds — of accounts coexist on the same IPv4. Each sends mail with that IP. The IP's reputation is **shared**: if a single account sends spam, is compromised, or exceeds a sending quota, the entire address range can be blacklisted.\n\nReceivers like Gmail or Outlook evaluate the IP in the SMTP envelope. When that IP appears on a blacklist (Spamhaus, Barracuda, Invaluement…), all messages from it are rejected or relegated to spam. In SMTP terms, your client receives a `550 5.7.1 Message rejected` or a `421 Try again later` directly in the server logs.\n\nFor an agency managing a portfolio of sites, the exposure is proportional to the number of clients on the same IP pool. A poorly configured campaign from a neighbour penalises the entire estate — a structural fragility of shared hosting that a dedicated VPS SMTP relay eliminates entirely.",{"type":35,"title":36,"items":37},"ul","What you gain with a dedicated SMTP relay",[38,39,40,41,42,43,44],"**Clean, exclusive IPv4**: you are the sole sender; you have complete control over the IP's reputation.","**DKIM signed at the source**: every message carries a verifiable cryptographic signature, independent of the shared hosting infrastructure.","**Aligned SPF and DMARC**: all three DNS records can point to your VPS, satisfying Google and Outlook's requirements for volumes above 5,000 emails per day.","**One relay for the entire estate**: shared hosting sites, Laravel, Node.js and WordPress applications all send via `localhost:587` on the VPS without changing any application logic.","**Per-account SASL control**: create a separate identity per client domain — if one account is compromised you revoke it without affecting others.","**Independence from third-party pricing**: you step out of reliance on volume-billed SMTP relay providers whose pricing grids were revised upwards during 2025-2026.","**Full observability**: `\u002Fvar\u002Flog\u002Fmail.log` gives you the exact trace of every send, bounce and rejection.",{"type":31,"title":46,"body":47},"Architecture: relay-only, not a full MX server","It is important to distinguish two roles. A **full MX server** (such as Mailcow, covered in our dedicated article) manages mailboxes, inbound mail reception and a webmail interface.\n\nAn **SMTP relay** does one thing only: relay outbound sending. It receives no external mail, hosts no mailboxes, exposes no webmail interface. Postfix configured as `relay-only` listens only on `localhost`, accepts SASL-authenticated connections from local applications or authorised shared hosting servers, signs with OpenDKIM, and forwards to the final recipient.\n\nThis architecture has three practical advantages for an agency:\n\n— **Reduced attack surface**: with no exposure on port 25 from the Internet, the risk of open relay or abuse is near zero.\n\n— **No mailbox management**: your clients keep their Gmail, Microsoft 365 or cPanel Mail boxes unchanged.\n\n— **Deployment in under an hour**: the procedure below is reproducible on any Linux VPS (Debian 12 \u002F Ubuntu 22.04) by an administrator with intermediate system skills.",{"type":31,"title":49,"body":50},"Prerequisites before you start","Verify these four points before starting the installation.\n\n**1. A VPS with at least 1 GB of RAM.** Postfix and OpenDKIM are lightweight. A Start plan is more than enough for a portfolio of 20 to 50 client sites.\n\n**2. Port 587 open, never port 25.** Cloud VPS operators block outbound port 25. Use port 587 (SMTP with STARTTLS and SASL authentication).\n\n**3. A PTR record configured on the VPS IPv4.** Gmail and Outlook systematically verify this PTR and reject connections from IPs without a valid rDNS. Request its configuration from ServOrbit support.\n\n**4. A dedicated relay domain with DNS access.** You will need to publish an SPF record and a DKIM TXT record on this domain.",{"type":52,"title":53,"steps":54},"steps","Step-by-step installation and configuration",[55,58,61,64,67,70,73],{"title":56,"body":57},"Install Postfix and OpenDKIM","Connect as root to your VPS, then run:\n\n```bash\napt update && apt install -y postfix opendkim opendkim-tools swaks libsasl2-modules\n```\n\nDuring installation, `dpkg-reconfigure postfix` offers a wizard. Choose **Internet Site** and enter your relay hostname (`relay.youragency.com`).",{"title":59,"body":60},"Configure \u002Fetc\u002Fpostfix\u002Fmain.cf","Replace the content of `\u002Fetc\u002Fpostfix\u002Fmain.cf`:\n\n```bash\nmyhostname = relay.youragency.com\nmydomain = youragency.com\nmyorigin = $mydomain\ninet_interfaces = all\ninet_protocols = ipv4\nmydestination =\nrelayhost =\nmynetworks = 127.0.0.1\u002F32 [::1]\u002F128 YOUR_SHARED_IP\u002F32\nsmtp_use_tls = yes\nsmtp_tls_security_level = may\nsmtpd_use_tls = yes\nsmtpd_tls_cert_file = \u002Fetc\u002Fletsencrypt\u002Flive\u002Frelay.youragency.com\u002Ffullchain.pem\nsmtpd_tls_key_file = \u002Fetc\u002Fletsencrypt\u002Flive\u002Frelay.youragency.com\u002Fprivkey.pem\nsmtpd_sasl_auth_enable = yes\nsmtpd_sasl_type = cyrus\nsmtpd_sasl_path = smtpd\nsmtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject\n```",{"title":62,"body":63},"Generate and deploy DKIM keys with OpenDKIM","```bash\nmkdir -p \u002Fetc\u002Fopendkim\u002Fkeys\u002Fyouragency.com\nopendkim-genkey -s mail -d youragency.com -b 2048 -D \u002Fetc\u002Fopendkim\u002Fkeys\u002Fyouragency.com\u002F\nchown -R opendkim:opendkim \u002Fetc\u002Fopendkim\u002Fkeys\u002F\nchmod 700 \u002Fetc\u002Fopendkim\u002Fkeys\u002Fyouragency.com\u002F\n```\n\nEdit `\u002Fetc\u002Fopendkim.conf`:\n\n```bash\nDomain youragency.com\nKeyFile \u002Fetc\u002Fopendkim\u002Fkeys\u002Fyouragency.com\u002Fmail.private\nSelector mail\nSocket inet:12301@localhost\nUMask 002\n```",{"title":65,"body":66},"Connect Postfix to OpenDKIM via milter","Add to `\u002Fetc\u002Fpostfix\u002Fmain.cf`:\n\n```bash\nmilter_protocol = 6\nmilter_default_action = accept\nsmtpd_milters = inet:localhost:12301\nnon_smtpd_milters = inet:localhost:12301\n```\n\nRestart both services:\n\n```bash\nsystemctl enable --now opendkim\nsystemctl restart postfix\n```",{"title":68,"body":69},"Publish the DNS records","Retrieve the DKIM public key: `cat \u002Fetc\u002Fopendkim\u002Fkeys\u002Fyouragency.com\u002Fmail.txt`\n\nPublish SPF:\n```bash\nyouragency.com IN TXT \"v=spf1 ip4:YOUR_VPS_IP ~all\"\n```\n\nAnd DMARC:\n```bash\n_dmarc.youragency.com IN TXT \"v=DMARC1; p=quarantine; rua=mailto:dmarc@youragency.com; fo=1\"\n```",{"title":71,"body":72},"Test the relay and validate the signature","```bash\nswaks --to test@example.com --server localhost:587 \\\n  --auth PLAIN --auth-user relay@youragency.com \\\n  --auth-password YOURPASSWORD \\\n  --tls\n```\n\nCheck `\u002Fvar\u002Flog\u002Fmail.log` for `status=sent`. Send a message to `check-auth@verifier.port25.com` to validate DKIM alignment.",{"title":74,"body":75},"Configure client sites to use the relay","**Via cPanel \u002F WHM**: in WHM, *Exim Configuration Manager* → *Basic Editor* → *Outgoing Mail*, enable smart host pointing to your VPS IPv4, port 587.\n\n**Via Laravel `.env`**:\n```bash\nMAIL_MAILER=smtp\nMAIL_HOST=VPS_IP\nMAIL_PORT=587\nMAIL_USERNAME=relay@youragency.com\nMAIL_PASSWORD=YOURPASSWORD\nMAIL_ENCRYPTION=tls\n```\n\n**Via WordPress \u002F WooCommerce**: install *WP Mail SMTP* or *Post SMTP* plugin with the same parameters.\n\n**Via Node.js \u002F Nodemailer**: `host: 'VPS_IP', port: 587, secure: false, auth: { user: 'relay@youragency.com', pass: 'YOURPASSWORD' }`.",{"type":77,"body":78},"tip","For a portfolio of more than 20 client sites, create **a separate SASL account per client domain**. If a client is compromised you revoke only their identifier without interrupting service for others. With OpenDKIM in `SigningTable` mode, each client domain can also sign with its own DKIM key — DMARC alignment becomes perfect for every sender in the portfolio.",{"type":31,"title":80,"body":81},"Post-installation: monitor reputation and anticipate issues","**Monitor `\u002Fvar\u002Flog\u002Fmail.log` daily.** Lines `status=bounced` or `status=deferred` deserve immediate attention: they contain the exact message from the remote server.\n\n**Subscribe to Google and Microsoft Postmaster Tools.** \u003Ca href=\"https:\u002F\u002Fpostmaster.google.com\">Google Postmaster Tools\u003C\u002Fa> gives you a domain and IP reputation dashboard, spam rate and delivery rate. Microsoft SNDS offers an equivalent view for Outlook.\n\n**Check blacklists at least once a week.** \u003Ca href=\"https:\u002F\u002Fmxtoolbox.com\u002Fblacklists.aspx\">MXToolbox Blacklist Check\u003C\u002Fa> checks your IP against more than 100 lists in seconds.\n\n**Rate-limit per SASL account.** Postfix's `smtpd_client_message_rate_limit` and `anvil_rate_time_unit` limit messages per time unit. A compromised account sending 10,000 emails in an hour will be blocked before it impacts your IP reputation.",{"type":31,"title":83,"body":84},"Troubleshooting: the five most common errors","**1. `status=bounced (550 5.7.1)`** — IPv4 blacklisted or PTR missing. Check on \u003Ca href=\"https:\u002F\u002Fmxtoolbox.com\u002Fblacklists.aspx\">mxtoolbox.com\u002Fblacklists\u003C\u002Fa>.\n\n**2. `DKIM=fail`** — verify: `dig TXT mail._domainkey.youragency.com`. Ensure the DNS value is on a single line.\n\n**3. Port 587 connection refused** — `ufw allow 587\u002Ftcp`. Verify Postfix listens: `ss -tlnp | grep :587`.\n\n**4. Valid DKIM but still spam** — DMARC alignment requires `From:` domain matches DKIM domain. Configure per-client DKIM selectors.\n\n**5. Silent mail.log** — check `systemctl status postfix`. On some distributions, mail logs are in `\u002Fvar\u002Flog\u002Fsyslog` only.",{"type":31,"title":86,"body":87},"A shared relay for the entire portfolio, a controlled reputation","In two hours of configuration, a Start VPS hosts a Postfix relay ready to route transactional mail for an entire client portfolio. The dedicated IPv4 stays under your exclusive control, the DKIM signature is verifiable, and both SPF and DMARC are aligned from first use.\n\nOur article on **SPF, DKIM and DMARC** covers the DNS records in detail. If you also want to host your clients' mailboxes, our Mailcow guide describes setting up a full MX server on VPS.","A VPS to relay your entire client portfolio","A Power VPS is enough to relay transactional mail for 20 to 50 client sites — dedicated IPv4 included, root access, up and running in under 10 minutes.","Discover the agency offer","\u002Fsolutions\u002Fagences",[93,107,121],{"id":94,"slug":95,"slugs":96,"title":99,"excerpt":100,"readTime":19,"views":101,"isPinned":16,"publishedAt":102,"category":103,"categories":104,"featuredImage":25,"bgImage":26,"posterImage":106,"relatedSolution":25},238,"hosting-your-own-email-server-on-a-vps-with-mailcow",{"fr":97,"en":95,"ar":98},"heberger-serveur-email-vps-mailcow","استضافة-خادم-البريد-الإلكتروني-على-vps-باستخدام-mailcow","Hosting Your Own Email Server on a VPS with Mailcow","Deploy Mailcow on a Linux VPS to run your own sovereign email server: installation, deliverability and migration from Google Workspace.",1,"2026-08-08T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},[105],{"id":19,"name":20,"slug":21,"color":22,"icon":21},"\u002Fblog\u002Fcovers\u002Fheberger-serveur-email-vps-mailcow-poster.svg",{"id":108,"slug":109,"slugs":110,"title":113,"excerpt":114,"readTime":115,"views":15,"isPinned":16,"publishedAt":116,"category":117,"categories":118,"featuredImage":25,"bgImage":26,"posterImage":120,"relatedSolution":25},199,"spf-dkim-dmarc-passing-the-5000-email-threshold",{"fr":111,"en":109,"ar":112},"spf-dkim-dmarc-delivrabilite-emails-pro","spf-وdkim-وdmarc-تجاوز-عتبة-5000-رسالة","SPF, DKIM, DMARC: passing the 5,000-email threshold","Gmail and Outlook reject senders without aligned SPF, DKIM and DMARC with an SMTP 550 error. Here is how to configure all three records.",4,"2026-08-01T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},[119],{"id":19,"name":20,"slug":21,"color":22,"icon":21},"\u002Fblog\u002Fcovers\u002Fspf-dkim-dmarc-delivrabilite-emails-pro-poster.svg",{"id":122,"slug":123,"slugs":124,"title":127,"excerpt":128,"readTime":115,"views":15,"isPinned":16,"publishedAt":129,"category":130,"categories":131,"featuredImage":25,"bgImage":26,"posterImage":133,"relatedSolution":25},215,"migrating-professional-email-leaving-gmail-and-microsoft-365",{"fr":125,"en":123,"ar":126},"migrer-email-pro-quitter-gmail-microsoft-365","الانتقال-من-gmail-وmicrosoft-365-نقل-بريدك-المهني","Migrating professional email: leaving Gmail and Microsoft 365","Microsoft 365 raised prices in 2026 and EWS shuts down in October. Here's how to migrate your business email without interruption.","2026-08-03T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},[132],{"id":19,"name":20,"slug":21,"color":22,"icon":21},"\u002Fblog\u002Fcovers\u002Fmigrer-email-pro-quitter-gmail-microsoft-365-poster.svg",1787581011006]