HELPER VPS

Sending email from a VPS: connect an SMTP sending service on ports 587 and 465

Every HELPER VPS server keeps outgoing port 25 closed to stop spam, which keeps the IP reputation clean for every server on the shared network. Send email through port 587 or 465 of a mail sending service and it lands in inboxes more reliably.

Why send through ports 587 and 465?

Port 25 is the port mail servers use to hand mail to each other. Sending straight from your server to the receiving mail server means handling IP reputation, reverse DNS and sending volume yourself, and mail from a new server IP easily ends up in spam.

Ports 587 and 465 are submission ports where logged-in users hand over mail. Log in to a mail sending service with a username and password and hand over your mail, and its well-maintained sending servers deliver it for you. It is the surest way to get emails such as sign-up confirmations, password resets and order notifications into inboxes.

  • Port 587: connects in plain text and then starts encryption with STARTTLS. It is the default port for most services and programs.
  • Port 465: connects encrypted with TLS from the start. Settings screens often label it SSL or SSL/TLS.

Choosing a mail sending service

There are two main kinds of mail sending services. One is transactional email services that send notification emails from websites and apps in volume; the other is the SMTP feature of a company or personal email account you already use. Either way, have the four pieces of information below and you are ready to set up.

  • SMTP server address: for example, smtp.example.com
  • Port: 587 (STARTTLS) or 465 (SSL/TLS)
  • Username: the username or email address given by the service
  • Password: the service's dedicated SMTP password or API key

For high-volume online stores and services, transactional email services are convenient, handling sending logs, bounces and unsubscribes for you. For a few notifications, an email account's SMTP is enough.

Check the SMTP connection from your server

Before setting up, check that your server can reach the sending service. The commands below only test the connection and do not send any mail.

Terminal
nc -vz smtp.example.com 587
openssl s_client -starttls smtp -connect smtp.example.com:587 -crlf -quiet
openssl s_client -connect smtp.example.com:465 -crlf -quiet

If the first line shows succeeded or open, and the openssl command shows a server greeting starting with 220, you are ready. Exit with Ctrl+C. If the nc command is missing, install it with apt install -y netcat-openbsd on Ubuntu and Debian, or dnf install -y nmap-ncat on AlmaLinux.

Connect Postfix to a sending service

To collect mail sent by programs on the server, cron notifications and the mail command in one place, set up Postfix as a relay that hands mail to the sending service. All mail from the server goes out by logging in on port 587.

Step 1. Install

Ubuntu, Debian
apt install -y postfix libsasl2-modules mailutils

When asked for the mail configuration type during installation, choose Internet Site, and enter your domain as the mail name. On AlmaLinux 10, install with dnf install -y postfix cyrus-sasl-plain s-nail and turn it on with systemctl enable --now postfix.

Step 2. Relay settings

Terminal
postconf -e 'relayhost = [smtp.example.com]:587'
postconf -e 'smtp_sasl_auth_enable = yes'
postconf -e 'smtp_sasl_password_maps = texthash:/etc/postfix/sasl_passwd'
postconf -e 'smtp_sasl_security_options = noanonymous'
postconf -e 'smtp_tls_security_level = encrypt'
postconf -e 'inet_interfaces = loopback-only'

inet_interfaces = loopback-only makes it accept only mail sent from within the server, so this server cannot be used as a mail relay from outside.

Step 3. Save login details

Terminal
echo '[smtp.example.com]:587 SMTP_USER:SMTP_PASSWORD' > /etc/postfix/sasl_passwd
chmod 600 /etc/postfix/sasl_passwd
systemctl restart postfix

If your service uses port 465, change the port in relayhost and sasl_passwd to 465 and add one more line, postconf -e 'smtp_tls_wrappermode = yes'.

Step 4. Test send and check logs

Terminal
echo "VPS mail test" | mail -s "Test from VPS" you@example.com
postqueue -p
journalctl -t postfix/smtp -n 20

If you see status=sent in the log, the sending service has accepted the mail. postqueue -p shows mail that has not gone out yet. If you fixed the login details, resend with postqueue -f after systemctl restart postfix.

SMTP settings in WordPress and apps

Most websites and apps have SMTP settings, so you can connect straight to the sending service without Postfix on the server. For WordPress, install an SMTP plugin and enter the values below, and sign-up and password reset emails go out through that service.

  • SMTP host: the sending service address
  • Encryption: TLS (STARTTLS) for 587, SSL for 465
  • Port: 587 or 465
  • Authentication: on, with username and password
  • From address: an address on your domain (for example, no-reply@example.com)

Node.js, PHP and Python apps set up their mail libraries with the same values. Rather than writing the password directly in code, put it in an environment variable or config file for a clean setup. Installing WordPress is covered in the WordPress install guide.

Add SPF, DKIM and DMARC to your domain DNS

Receiving mail servers use DNS records to check whether a message really came from a place your domain authorized. Adding these three records greatly improves inbox delivery.

  • SPF: the list of servers allowed to send mail for your domain. Put the include value given by your sending service in a single TXT record.
  • DKIM: a digital signature attached to your mail. Add the TXT or CNAME record created in your sending service's dashboard as is.
  • DMARC: decides what happens to mail that fails SPF and DKIM checks. Start with a report-only setting as below.
DNS TXT
_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

After a few weeks of reading reports and confirming all your mail passes, raise it to p=quarantine and then p=reject to stop people impersonating your domain.

Receiving email and next steps

To receive mail sent to your domain, add your mail hosting service's MX records to the domain. With mail hosting handling incoming mail and the sending service handling outgoing notifications, your server can focus on your website and apps.

Sending through a mail sending service carries on as is even if you move or recreate the server; just move a few lines of settings. Your sending reputation stays with the service even if your server IP changes, so delivery rates hold steady when you move your site to another region.

Open other ports freely to suit your service. How to open only the ports you use is in the basic firewall guide, and server usage rules are in the acceptable use policy.

Related guides

Settings worth doing right after this guide.

View all guides