What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To run email from a VPS, install Postfix as the SMTP transfer service, optionally add Dovecot for mailbox access and SMTP authentication, secure authenticated submission with TLS, and publish DNS records that identify and authorize your server. A reliable setup also requires a static public IP, aligned forward and reverse DNS, strict relay rules, provider permission for mail traffic, and ongoing queue, abuse and reputation monitoring. The steps below use Ubuntu and the hostname mail.example.com; replace that name with your own fully qualified domain name.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Understand what an SMTP service on a VPS actually includes
“SMTP server” can describe several separate jobs. Keeping them distinct prevents a common mistake: installing a transfer agent and assuming users can automatically log in, read mail and send authenticated messages.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
Postfix transfers messages
Postfix is the mail transfer agent (MTA). It accepts messages from local applications or authenticated clients, decides whether a destination is local or remote, places messages in a queue, and delivers them to other mail servers. Canonical identifies Postfix as Ubuntu’s default supported MTA.
Dovecot provides mailbox access and can provide SASL
Dovecot is normally used for IMAP or POP3 access to stored mail. It can also expose a SASL authentication socket that Postfix uses for SMTP-AUTH. Installing Dovecot is therefore optional when the VPS only sends system mail, but it is normally required when people or applications must authenticate to a submission service.
#1 Best Overall
Submission, delivery and mailbox access are different paths
- Port 25: server-to-server SMTP and, depending on policy, local delivery. It is frequently restricted by VPS providers.
- Port 587: authenticated message submission for users and applications. Require TLS before accepting credentials.
- IMAP or POP3: mailbox retrieval, usually supplied by Dovecot. These protocols are not SMTP.
SMTP-AUTH lets a client identify itself through the Simple Authentication and Security Layer (SASL) mechanism. Authentication must grant submission rights without turning the VPS into an open relay.
Check prerequisites before installing anything
Resolve infrastructure constraints first. Correct configuration cannot compensate for a blocked port, missing reverse DNS or an address with a poor sending reputation.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- A VPS with a static public IPv4 address. If you intend to send over IPv6, obtain a stable IPv6 address and publish matching DNS as well.
- A fully qualified hostname such as
mail.example.com. The VPS hostname, SMTP greeting, certificate name and forward DNS should agree. - Control of the DNS zone for your sending domain, for example
example.com. - A provider policy that permits mail traffic, including outbound TCP port 25 and reverse-DNS (PTR) changes. Policies and abuse procedures vary by provider; confirm them before deployment.
- A decision about whether this server will deliver directly to recipient MX servers or submit outbound mail to a relay. The choice changes your DNS, reputation and operations work.
Set the operating-system hostname before requesting a certificate or testing mail:
sudo hostnamectl set-hostname mail.example.com
hostname --fqdnThe second command should return the same fully qualified name. Add a matching entry in /etc/hosts if your distribution requires one, while ensuring that public DNS remains authoritative for Internet clients.
Choose direct delivery or an SMTP relay
Postfix can connect directly to recipient mail servers, or it can hand outbound messages to a relay. Neither approach guarantees inbox placement. Use the comparison to select an operational model rather than treating a relay as a universal deliverability fix.
| Consideration | Direct delivery from the VPS | Outbound SMTP relay |
|---|---|---|
| Control over data and configuration | Maximum control over queues, policies and message flow. | Some headers, retention and rate controls are determined by the relay. |
| Sender reputation | You build and protect the VPS IP and domain reputation yourself. | The relay supplies an established sending network, but your domain reputation still matters. |
| Deliverability monitoring | You must watch bounces, rejection logs, blocklists and feedback. | The relay may provide dashboards and event data, subject to its service. |
| Port and reverse-DNS policy | Requires provider permission for port 25 and a usable PTR record. | Usually avoids direct port-25 delivery from your VPS; the relay handles its own infrastructure. |
| Recurring cost | No relay subscription, but administration and abuse response consume time. | Usually a recurring fee or usage charge. |
| Authentication records | You must publish SPF and any DKIM or DMARC records required by recipients. | SPF must authorize the relay’s sending path; DKIM signing may be performed by the relay or your server. |
| Best fit | Operators who need full control and can manage reputation and security. | Teams that prioritize operational support or cannot obtain suitable port-25 and PTR service. |
If a provider blocks outbound port 25, do not attempt to bypass that policy. Configure Postfix to use an authenticated relay or move mail delivery to infrastructure that explicitly supports it.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Install Postfix on Ubuntu
Run the package installation
- Update package metadata and install Postfix:
sudo apt update sudo apt install postfix - When the package asks for a configuration type, select Internet Site for a VPS intended to send and receive mail directly. If you already know that all outbound mail will go through a relay, you can still install Postfix now and configure the relay parameters afterward.
- For the system prompts, decide the accepted domain, server network range, username and mailbox format before accepting defaults. Ubuntu’s mail-service guidance calls out these decisions because they determine which messages are local and which clients are trusted.
Check that the service is running:
sudo systemctl enable --now postfix
sudo systemctl status postfix --no-pagerThe service should show an active state. If it fails, inspect the syntax and journal before changing settings:
sudo postfix check
sudo journalctl -u postfix -n 100 --no-pagerSet Postfix’s identity, local domains and relay policy
Postfix reads its main settings from /etc/postfix/main.cf. Back up the file before editing and use postconf for individual parameters so accidental formatting errors are less likely.
Rank #2
- Mastering Active Directory: Design, deploy, and protect Active Directory Domain Services for Windows Server 2022, 3rd Edition
- ABIS BOOK
- Packt Publishing
sudo cp /etc/postfix/main.cf /etc/postfix/main.cf.backup
sudo postconf -e 'myhostname = mail.example.com'
sudo postconf -e 'mydomain = example.com'
sudo postconf -e 'myorigin = $mydomain'
sudo postconf -e 'mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain'
sudo postconf -e 'mynetworks = 127.0.0.0/8 [::1]/128'
sudo postconf -e 'relay_domains ='
The exact local-domain list depends on your design. Include a domain in mydestination only when this server is responsible for receiving that domain’s mail. Add your private application or office subnets to mynetworks only when they are genuinely trusted; never paste a whole public address range into this setting.
Prevent an open relay
Relay permission must be limited to authenticated users and explicitly trusted networks. A typical restriction is:
sudo postconf -e 'smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination'reject_unauth_destination refuses unauthenticated attempts to deliver mail for arbitrary external domains. Do not remove it merely because a test client receives a rejection; that rejection is the protection you want.
Choose a mailbox format deliberately
Ubuntu’s installer asks whether to use traditional mbox storage or Maildir. Maildir stores each message as a separate file and is commonly selected for Dovecot deployments, while mbox keeps messages together in mailbox files. Whichever format you choose, configure Postfix and Dovecot to use the same location and test delivery to a real local account.
After changes, validate and reload:
sudo postfix check
sudo systemctl reload postfixUse postconf -n to review only non-default settings. Save that output with your deployment notes so you can detect an accidental trust or relay change later.
Add Dovecot for authenticated SMTP and mailbox access
Install the core package
sudo apt install dovecot-coreAdd the IMAP or POP3 packages only if clients must retrieve mail. The important SMTP integration is Dovecot’s SASL socket, which Postfix accesses through its private directory.
Expose the Postfix authentication socket
Edit Dovecot’s service configuration, commonly /etc/dovecot/conf.d/10-master.conf, and add or enable an auth listener for Postfix. A standard arrangement places the socket at /var/spool/postfix/private/auth and grants it to the Postfix user and group:
service auth {
unix_listener /var/spool/postfix/private/auth {
mode = 0660
user = postfix
group = postfix
}
}The path and ownership must match the Postfix chroot layout on your Ubuntu release. If your package already contains a commented listener, modify that block rather than creating two listeners with conflicting permissions.
Enable safe authentication mechanisms
In Dovecot’s authentication configuration, commonly /etc/dovecot/conf.d/10-auth.conf, enable mechanisms that work over TLS. Do not permit plaintext credentials on an unencrypted connection. For example:
auth_mechanisms = plain loginThose mechanism names do not make an unencrypted service safe by themselves. Postfix must require TLS before accepting authenticated submission, and client passwords must be protected as secrets.
Point Postfix at Dovecot SASL
sudo postconf -e 'smtpd_sasl_type = dovecot'
sudo postconf -e 'smtpd_sasl_path = private/auth'
sudo postconf -e 'smtpd_sasl_auth_enable = yes'
sudo postconf -e 'smtpd_sasl_security_options = noanonymous'
sudo postconf -e 'smtpd_tls_auth_only = yes'
Restart Dovecot and reload Postfix:
sudo systemctl restart dovecot
sudo systemctl reload postfix
sudo systemctl status dovecot --no-pagerIf authentication fails, check that the socket exists inside the Postfix spool, that its owner and mode permit Postfix access, and that the Dovecot account can authenticate independently.
Configure TLS and the submission service
Use a certificate for the SMTP hostname
Obtain a certificate whose name covers mail.example.com. Configure Postfix with the server certificate, private key and issuing chain. Postfix’s TLS documentation requires the server certificate to be presented with the issuing chain in the required order; a missing intermediate certificate can make some clients reject the connection even when browsers appear to work.
sudo postconf -e 'smtpd_tls_cert_file = /path/to/full-chain.pem'
sudo postconf -e 'smtpd_tls_key_file = /path/to/private-key.pem'
sudo postconf -e 'smtpd_tls_security_level = may'
sudo postconf -e 'smtpd_tls_loglevel = 1'
Restrict the private key to root and the service account as appropriate for your certificate-management method. Reload Postfix after every certificate renewal and verify that renewal hooks do not leave the daemon using an expired file.
Require encryption for authenticated users
Port 25 often uses opportunistic TLS because recipient servers differ in their TLS support. Authenticated submission is different: credentials should never cross the network before encryption. The smtpd_tls_auth_only = yes setting enforces that distinction. If your delivery environment requires encrypted server-to-server transport, configure outbound TLS policy deliberately; enforcing TLS to every destination can prevent delivery to servers that do not support it.
Enable port 587 submission
In /etc/postfix/master.cf, enable the submission service and apply submission-specific options. A representative service definition is:
submission inet n - y - - smtpd
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
Keep the indentation used by your package’s file. The service should require STARTTLS before authentication and should accept relay only from authenticated clients. Open TCP port 587 in the VPS firewall if clients connect remotely:
Rank #4
- Standard size: 6 pink server note pads, Each Book Comes with 50 bound order slips - that's 300 ticket sheets total! Check Pads Size 6.75 x 3.5 inch.
- Convenient Work: These guest check books for servers have a tear-free dotted line that is easy to rip off. You can give as a customer copy or keep for record keeping. We've provided extra rows on the back for additional note taking.Perfect For Restaurants, Lounges, Hotels, Cafes, And Waiters To Use.
- Record Important Information: These server note pads can record important information.Each ticket has a unique serial number printed at the top, dates, order details, number of guests, order amount, table numbers etc. They are lightweight, small and can fit most aprons. They can be used on-demand and can help decrease errors in orders, while improving work efficiency.
- High Quality: Sturdy, Not Drop Powder, It's Thick, You Can Write On The Back And Front Easily.Their whole page printing has clear handwriting and a reasonable layout. On the customer retention part of each guest check, "THANK YOU" on the back to make customers feel appreciated.
- Contact Us: We're confident that the quality of the server note pads will go beyond your expectation. If you experience an issue, feel free to contact us, we'll appreciate it to learn from your experience, and we'll make it better
sudo ufw allow 587/tcp
sudo ufw statusDo not expose an administrative or unauthenticated submission endpoint simply because a client setup wizard requests one.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Publish DNS records and align server identity
Forward and reverse DNS
Create an A record (and an AAAA record if you send over IPv6) for mail.example.com pointing to the VPS address. Ask the VPS provider to set the address’s PTR record to the same hostname. The forward lookup, reverse lookup, SMTP banner and certificate name should tell a consistent story. Misalignment is a frequent reason receiving systems distrust a new server.
SPF authorizes the actual sending path
SPF is a DNS policy listing which hosts may send mail for a domain. Publish one SPF TXT record for the domain and include every legitimate sender: the VPS address for direct delivery, a relay’s include mechanism when using one, or both when both paths are active. Keep the policy synchronized with the real path; authorizing an old server does not authorize a replacement.
SPF alone does not prove that a message was not modified and does not guarantee inbox placement. Recipients may also expect DKIM signatures and a DMARC policy. Add those records when your chosen mail flow supports them, and ensure their domains align with the visible From address.
Check records from outside the VPS
Use independent DNS resolvers or an external DNS diagnostic service to confirm that public resolvers see the intended A, AAAA, PTR, MX, SPF and any DKIM or DMARC records. Testing only with the VPS’s local resolver can hide delegation or propagation mistakes.
Test SMTP at the protocol level
Check the public SMTP greeting and capabilities
From a host that can reach the VPS, connect to port 25:
telnet mail.example.com 25At the prompt, identify the client and request capabilities:
ehlo mail.example.comUbuntu’s example expects capability lines that include 250-STARTTLS and, when SMTP-AUTH is enabled for that service, 250-AUTH. A missing STARTTLS line means the listener is not offering encryption. A missing AUTH line may be intentional on port 25 but should be investigated on port 587.
Exit the session without sending a message:
quitInspect the TLS handshake
openssl s_client -starttls smtp -connect mail.example.com:587 -servername mail.example.com -crlfConfirm that the certificate subject or SAN contains the hostname, that the chain validates, and that the negotiated protocol is acceptable. After the handshake, issue EHLO again to view encrypted capabilities. Never paste a real password into a diagnostic transcript.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsBest Value
Test authenticated submission with a real client
Configure an email client or application with:
- SMTP host:
mail.example.com - Port:
587 - Security: STARTTLS required
- Authentication: the Dovecot account and its password
- From address: a domain authorized by your DNS and Postfix policy
Send first to a mailbox you control, then to a second provider. Record the full headers and the exact SMTP response. A successful local submission only proves that your server accepted the message; it does not prove remote delivery or inbox placement.
Read logs and troubleshoot by symptom
| Symptom | Likely cause | What to check |
|---|---|---|
| Connection to port 25 times out | Provider or firewall blocks SMTP. | Check provider policy, VPS firewall rules and listening sockets with ss -ltnp. |
| “Relay access denied” for a remote recipient | The client is unauthenticated or the destination is not local. | Use port 587 with STARTTLS and valid SASL credentials; keep reject_unauth_destination enabled. |
| AUTH is absent after EHLO | SASL is disabled on that listener, or Postfix cannot access Dovecot’s socket. | Check smtpd_sasl_auth_enable, the socket path, ownership, Dovecot status and the listener’s service options. |
| Authentication fails despite a correct password | Wrong account database, disabled mechanism or TLS requirement mismatch. | Test the Dovecot account, inspect Dovecot authentication logs and ensure the client starts TLS before AUTH. |
| TLS handshake reports an unknown issuer | The issuing chain is incomplete or in the wrong order. | Install the full chain in the certificate file and retest with openssl s_client. |
| Messages remain in the queue | DNS, network, recipient rejection or temporary remote failure. | Run mailq, inspect Postfix delivery logs and read the remote SMTP response before retrying. |
| Mail reaches spam | Weak or new IP reputation, missing sender authentication, identity mismatch or unwanted content. | Verify forward and reverse DNS, SPF and any DKIM/DMARC requirements, then monitor bounces and complaint signals. |
On Ubuntu, follow the live service logs while reproducing one failure:
sudo journalctl -fu postfix
sudo journalctl -fu dovecotFor queued mail, mailq shows the queue ID and destination. Use that ID to locate the corresponding log entry rather than repeatedly resending the same message.
Secure and operate the service after deployment
Protect accounts and keys
- Use unique, long passwords for SMTP accounts and remove unused accounts.
- Keep private keys readable only by the processes that need them.
- Patch Ubuntu, Postfix, Dovecot and the TLS library promptly.
- Limit SSH access, use key-based administration and monitor failed logins.
- Never place an SMTP password in shell history, a public repository or an unencrypted application configuration file.
Control abuse and volume
Rate-limit application accounts and investigate sudden queue growth. A compromised credential can damage your domain and IP reputation within hours. Set sensible message-size, recipient-count and concurrency limits for the applications that use submission, and preserve enough logs to investigate abuse without retaining message content unnecessarily.
Free tools Windows power users keep installed
One-click scans. No signup required.
Monitor delivery rather than assuming success
Review queue length, SMTP rejection codes, deferred deliveries, bounce rates and provider complaints. Keep an eye on certificate expiry, DNS changes and disk space; a full queue partition can stop both incoming and outgoing mail. Maintain a tested backup and recovery plan for Dovecot mailboxes if the VPS stores user mail.
Understand what self-hosting does not guarantee
Installing Postfix does not guarantee delivery, an inbox placement rate or acceptance by every recipient. Receiving systems make independent decisions based on IP and domain reputation, authentication, content, user complaints and local policy. The reviewed Ubuntu and Postfix documentation does not establish a universal delivery percentage. Treat reputation and deliverability as ongoing operational responsibilities, not as installation features.
Use this deployment checklist
- Static public IP confirmed and provider mail policy checked.
mail.example.comresolves forward to the VPS, and PTR resolves back to that hostname.- Postfix installed as an Internet Site and the intended local domains and mailbox format selected.
myhostname,mydestinationand narrowly scopedmynetworksconfigured.reject_unauth_destinationactive so arbitrary unauthenticated relaying is impossible.- Dovecot SASL socket exists at the Postfix-accessible private path when authentication is required.
- Port 587 requires STARTTLS and SASL authentication; credentials are not accepted before TLS.
- Certificate covers the SMTP hostname and includes the issuing chain in the correct order.
- SPF authorizes the actual sending source; DKIM and DMARC are added when supported by the selected mail flow.
EHLOshows STARTTLS and the expected AUTH capability on the appropriate listener.- Local and remote test messages have been traced through queue and rejection logs.
- Patch, abuse response, queue monitoring, certificate renewal and mailbox backup procedures are documented.
Final decision: when this VPS setup is appropriate
A Postfix-and-Dovecot VPS is appropriate when you need control over transport, authentication and mailbox storage and are prepared to manage DNS, TLS, patching, abuse and reputation. Choose a relay when provider restrictions, staffing or deliverability monitoring make direct Internet delivery impractical. In either case, keep SMTP transport separate from mailbox access, require TLS for authenticated submission, authorize only the networks and users that should relay, and verify the complete path with protocol tests and external DNS checks.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
