VDS Mail Server Setup: rDNS, SPF, DKIM and DMARC

Running a Mail Server on a France VDS: rDNS, SPF, DKIM, DMARC and IPv6 Setup

Running a Mail Server on a France VDS: rDNS, SPF, DKIM, DMARC and IPv6 Setup

Running your own mail server gives you full control of your email: you set the sending limits, your data stays on your own server and your application's notifications do not depend on a third-party service. Setting up a mail server is easy; getting its messages into the inbox takes care. This guide walks through the five settings that decide deliverability on a France VDS mail server, in order: hostname, rDNS (PTR), SPF, DKIM and DMARC. Then it covers IPv6, IP reputation and testing.

Why a mail server in Europe?

If your customers and partners are in Europe, most of your mail goes to European mail servers. A France VDS offers a short network path to them and a European IP address. Keeping correspondence that contains European customers' personal data inside Europe also helps on the data protection side, as covered in our France VDS and GDPR guide. FR-S is enough for a lean Postfix and Dovecot setup; add spam filtering, antivirus and webmail and FR-M is a more comfortable start. Plans are listed on the France VDS page.

Which mail software?

There are several ways to build a mail server, and the right one depends on your team's experience. A manual build means configuring Postfix for sending and receiving, Dovecot for IMAP mailbox access, a spam filter and optionally a webmail client, each on its own. It is the most flexible route and teaches you every setting, but maintenance is entirely on you.

Ready-made mail bundles ship these components together with a web admin interface and simpler updates, and container-based bundles suit teams that already use Docker. If you also host websites, control panels such as cPanel, Plesk or DirectAdmin combine domains and mailboxes in one interface; you can add them as extras when ordering a France VDS. Whichever path you take, deliverability depends on the same settings, and the steps below apply to every setup.

Step 1: A proper hostname

Give the server a fully qualified name under your domain, such as mail.example.com. You can change it in the client panel or inside the OS:

hostnamectl set-hostname mail.example.com
echo "YOUR-IPV4 mail.example.com mail" >> /etc/hosts

Create an A record and, for IPv6, an AAAA record for this name. Hostname, A record and rDNS confirming each other is the first thing receivers check.

Step 2: The rDNS (PTR) record

rDNS maps an IP address back to a name. Receivers look up the sender IP; with no record, or a generic provider name, mail is often rejected or filed as spam. On a France VDS you set rDNS yourself in the client panel: point the IPv4 PTR to mail.example.com, and do the same for your IPv6 address if you use it.

dig -x YOUR-IPV4 +short
dig mail.example.com A +short

Both lookups should point at each other. This forward-confirmed reverse DNS (FCrDNS) is a baseline expectation at large mailbox providers.

rDNS changes can take from a few minutes to a few hours to propagate through DNS caches. If a test right after the change shows the old value, wait and try again.

Step 3: SPF

SPF publishes which servers may send mail for your domain:

example.com.  TXT  "v=spf1 ip4:YOUR-IPV4 ip6:YOUR-IPV6 -all"

Add include entries for any other sending services. Keep a single SPF record per domain and no more than ten DNS lookups inside it.

Step 4: DKIM signing

DKIM signs outgoing mail with a private key; receivers verify it with the public key in DNS, proving the message was not altered and really came from your domain.

apt install opendkim opendkim-tools
mkdir -p /etc/opendkim/keys/example.com
opendkim-genkey -b 2048 -d example.com -s mail -D /etc/opendkim/keys/example.com
cat /etc/opendkim/keys/example.com/mail.txt

Publish the public key as a TXT record at mail._domainkey.example.com, connect OpenDKIM to Postfix as a milter and look for dkim=pass in a test message header.

A France VDS for your mail server

IPv4 and IPv6 rDNS from the panel, a /64 IPv6 block and full admin access.

Explore the France VDS plans

Step 5: DMARC policy

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=s; aspf=s"

Start in monitoring mode, review the reports for a few weeks, and once all legitimate mail passes SPF and DKIM move to p=quarantine and then p=reject. A strict policy also stops others spoofing your domain.

Sending over IPv6

Every France VDS gets a /64 IPv6 block, and your mail server can send over IPv6. Large providers are stricter with IPv6 senders, so set a PTR record for the sending IPv6 address that matches its AAAA record, add it to SPF with ip6: and make sure every message carries a DKIM signature. If you cannot meet these conditions, send over IPv4 only:

postconf -e "inet_protocols = ipv4"
systemctl restart postfix

IP reputation and warm-up

A new IP has no history, and receivers distrust sudden high volume from unknown addresses. Warm the IP up: start with low-volume, high-engagement transactional mail such as password resets and order confirmations, then raise volume gradually over a few weeks. Keep lists clean, remove bounces, include an unsubscribe link in every newsletter, never mail purchased lists and check blocklists regularly.

Security: do not become an open relay

  • Let only authenticated users and local applications send through Postfix.
  • Use port 587 with TLS and authentication for submission.
  • Block repeated failed logins with Fail2ban.
  • Open only the ports you need (25, 587, 993) in the firewall.

For general hardening, see our Linux server security guide.

Testing deliverability

Send test messages to accounts at several providers and read the headers. You want to see:

Authentication-Results: ... spf=pass ... dkim=pass ... dmarc=pass

Then check your IP against blocklists and follow DMARC reports for a few weeks.

Common rejection messages and fixes

  • "Reverse DNS lookup failed" or "PTR record does not match": rDNS is missing or does not match the hostname. Check the PTR record in the client panel and make sure it points to the same name as the A record.
  • "SPF check failed" or "not permitted sender": the sending IP is missing from SPF. If you send over IPv6, you may have forgotten the ip6: entry.
  • "DKIM signature verification failed": the public key in DNS does not match the private key, or the signature breaks in transit. Check the selector name and the TXT record.
  • "Rejected due to the domain's DMARC policy": neither SPF nor DKIM passes in alignment with the domain. DMARC reports show which source fails.
  • "Listed on blocklist": your IP is on a blocklist. Make sure no spam leaves the server, then follow that list's removal process.

It also helps to separate application notifications from personal mail. Sending order and password emails from a subdomain such as notify.example.com keeps any reputation issue away from your main domain. Give each subdomain its own SPF, DKIM and DMARC records.

Checklist

SettingCorrect state
Hostnamemail.yourdomain.com with A and AAAA records
rDNSIPv4 and IPv6 PTR equal to the hostname, set in the panel
SPFOne record including IPv4 and IPv6
DKIM2048-bit key, dkim=pass in headers
DMARCp=none first, then quarantine and reject
SecurityNo open relay, 587 with TLS and auth, Fail2ban
ReputationGradual warm-up, clean lists, regular blocklist checks

Run your own mail server in Europe

France VDS with rDNS in the panel, a /64 IPv6 block and a gigabit port.

Browse the France VDS plans

Related Guides

Frequently Asked Questions

What is an rDNS (PTR) record and why is it needed?

rDNS is a reverse DNS record that maps an IP address to a hostname. Receiving mail servers check the sender IP's rDNS, and mail from servers with missing or mismatched records is often rejected or sent to spam.

How do I set rDNS on a France VDS?

Use the rDNS section of the client panel to set PTR records for your IPv4 and IPv6 addresses yourself. The record should match the server hostname and its A or AAAA record in DNS.

What is the difference between SPF, DKIM and DMARC?

SPF lists which servers may send for your domain, DKIM proves the message was not altered in transit, and DMARC tells receivers what to do when those checks fail. Use all three together.

What should I watch when sending email over IPv6?

Large mailbox providers apply stricter rDNS and authentication checks to mail arriving over IPv6. Set a PTR record for your IPv6 address and include it in your SPF record.

Can I send bulk email from a brand new IP?

New IP addresses have no reputation. Start with low volumes for a few weeks and increase gradually (IP warm-up) to protect deliverability.

How do I check whether my emails land in spam?

Send test messages to accounts at different providers and check SPF, DKIM and DMARC results in the headers. Also check regularly whether your IP is on any blocklists.

Server packages covered in this article

+902243340242