Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Run the website and email system on two independently addressable VPS instances: nginx or Apache2 on the web VPS, and Postfix plus Dovecot on the mail VPS. The website hostname points to the web server, while the domain’s MX record points to a dedicated mail hostname that resolves to the mail server. This separation limits the blast radius of failures, allows independent firewall and backup policies, and makes it easier to maintain each service without taking down the other.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The design only works reliably when DNS, reverse DNS, SMTP policy, TLS, authentication, and provider restrictions are planned together. The procedure below gives you an implementation order, example records, secure Postfix and Dovecot settings, certificate renewal steps, and tests for finding delivery or configuration failures before launch.
As an Amazon Associate I earn from qualifying purchases.
What the two-VPS architecture looks like
Use two hosts with separate public addresses. For illustration, the domain is example.com, the website is served from www.example.com and the mail server is named mail.example.com. Replace those names with your own registered domain and hostnames.
| Host | Primary services | DNS destination | Data and failure boundary |
|---|---|---|---|
| Web VPS | nginx or Apache2, application runtime, website files and databases | A/AAAA records for the apex and web hostnames | Web firewall, logs, snapshots and updates are independent |
| Mail VPS | Postfix for SMTP transfer, Dovecot for mailbox delivery and IMAP/POP3 access | mail.example.com A/AAAA record and the domain MX record |
Mail queues, mailbox data, mail logs and backups are independent |
When a browser requests the site, DNS sends it to the web VPS. When another mail server looks up the domain’s MX record, it receives mail.example.com, then resolves that name to the mail VPS. Mail clients connect to the mail VPS for IMAP or POP3 and submit outgoing messages through authenticated SMTP. The two servers do not need to share a private network, although a private network can be useful for administration and backups.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Set the mail server’s reverse-DNS (PTR) record to mail.example.com, and make sure forward DNS for that name returns the same mail IP. A mismatch is a common reason for delivery problems and reputation damage. Ask the VPS provider to set the PTR if its control panel does not expose that setting.
Prerequisites and provider checks
Before installing software, confirm that the infrastructure can support direct mail delivery. A low-cost VPS that blocks SMTP or refuses to set reverse DNS may be suitable for a website but unsuitable for a self-hosted mail server.
- Two VPS instances with current security updates, static public IPv4 addresses and, if you intend to use it, working IPv6.
- A registered domain whose DNS zone you can edit.
- Provider control over reverse DNS/PTR, or a support process that can set it to your requested hostname.
- Permission for inbound SMTP on TCP 25 and outbound delivery on TCP 25. Some providers block one or both directions until you request access.
- A documented abuse-response process. Compromised accounts can generate large queues quickly, so you need a way to suspend a host or obtain help.
- Snapshot or backup facilities, preferably with retention separate from the VPS disks.
- IPv6 that has usable reverse DNS and firewall support. If it does not, publish only IPv4 mail records until IPv6 is correctly configured.
| Capability to compare | Why it matters | What to verify |
|---|---|---|
| Static addressing | DNS records and reputation depend on stable addresses. | Whether an address is dedicated, retained through reboots, and available in the required region. |
| Reverse DNS | Receiving systems commonly evaluate the sending IP’s PTR name. | Self-service PTR editing or a documented support request. |
| SMTP policy | Port restrictions can prevent inbound or outbound delivery. | Inbound TCP 25, outbound TCP 25, submission ports, and any request process. |
| IPv6 behavior | An incorrectly configured AAAA record can make delivery fail even when IPv4 works. | Address allocation, routing, firewall rules and PTR support. |
| Firewall and private networking | Separate management and service traffic reduces exposure. | Stateful firewall controls, private interfaces and network ACLs. |
| Backups and snapshots | Mailboxes and queues need recovery plans different from web files. | Scheduling, retention, off-host copies and restoration testing. |
| DNS tooling | Mail depends on precise MX, TXT and host records. | AAAA, MX, SPF, DKIM, DMARC and optional TLSA record support. |
| Certificate automation | Expired certificates interrupt HTTPS and mail-client connections. | ACME support, renewal timers and deploy hooks. |
Choose names, addresses and responsibilities
Give the mail host a stable, descriptive name such as mail.example.com. The MX record must contain a hostname, never an IP literal. The name used in the Postfix hostname, the certificate, the PTR record and the SMTP greeting should be consistent.
Keep the web and mail credentials, queues, logs, backups and administrative access separate. A compromise of the web application should not automatically expose mailbox files, and a mail-account compromise should not provide shell access to the web server. Use different administrator keys and, where possible, separate monitoring credentials.
Harden both VPS instances first
- Apply updates. On each Ubuntu host, run
sudo apt updatefollowed bysudo apt full-upgrade, then reboot if the kernel or a critical service requires it. - Create an administrator. Add a non-root account, grant it administrative privileges, install your SSH public key, and verify that a second session can log in before changing the root account policy.
- Reduce SSH exposure. Disable password authentication and root SSH login where practical. Keep an existing console or recovery session open while testing the new settings so a typo does not lock you out.
- Enable a host firewall. Permit SSH only from trusted addresses when possible. Allow HTTP and HTTPS on the web VPS. On the mail VPS, allow SMTP server traffic, authenticated submission, and only the mailbox protocols you intend to offer.
- Separate management from service traffic. Do not expose database, cache, Dovecot administration, or backup ports to the public internet. Bind internal services to loopback or a private interface.
- Set time and logging policy. Accurate time is needed for log correlation and certificate validation. Retain authentication, web, SMTP and IMAP/POP3 logs long enough to investigate abuse.
- Plan recovery. Back up website files and databases on the web side, and mailbox data, Postfix queue state and Dovecot configuration on the mail side. Store copies off the individual VPS and test a restoration.
Do not open every port simply because a package may use it later. Add a rule only when a service is installed and tested, and remove rules for protocols you do not offer.
Install and publish the web VPS
Install the web server
Ubuntu supports both nginx and Apache2. Choose one as the public HTTP server unless you have a deliberate reverse-proxy design. Install it from the distribution packages, enable it at boot, and create a virtual host for the domain.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo apt update
sudo apt install nginx
sudo systemctl enable --now nginxFor Apache2, use the equivalent package and service commands, then enable the site-specific virtual host. Set the server name to the exact hostnames that will appear in the certificate. Keep application files and secrets outside the public document root, and run the application under a non-root service account.
Point web DNS and verify HTTP
Create A records for the apex or chosen web host and AAAA records only when IPv6 is fully routed and firewalled. Wait for the records to be visible from outside the provider network before requesting a certificate. Test both the bare domain and the canonical hostname, then configure one to redirect to the other so search engines and users see a single URL.
dig A example.com
dig AAAA example.com
dig A www.example.com
curl -I http://example.comThe expected result is an address belonging to the web VPS and an HTTP response from your virtual host, not the default page of an unrelated server.
Install Postfix and Dovecot on the mail VPS
Install the mail components
Postfix handles SMTP transfer; Dovecot delivers messages to local mailboxes and provides authenticated IMAP or POP3 access. Ubuntu identifies Postfix as its supported mail transfer agent and Dovecot as a mail delivery and access service. Canonical’s Ubuntu documentation states: “On Ubuntu, Postfix is the default supported MTA.”
sudo apt update
sudo apt install postfix dovecot-imapd dovecot-pop3dDuring the Postfix package dialog, select the internet-site role when the server will receive mail directly, and enter the fully qualified system name such as mail.example.com. If you choose a different package set or mailbox backend, adapt the paths and service names before applying the examples below.
Set the Postfix identity and accepted domain
In /etc/postfix/main.cf, define the mail hostname, the domain for which this server accepts mail, and the local mailbox format. A Maildir layout is convenient for Dovecot and can be represented as follows:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
home_mailbox = Maildir/Do not copy these values blindly if you host multiple domains, use virtual mailbox maps, or deliver to an external directory service. In those cases, configure explicit virtual-alias and mailbox maps and keep the accepted-domain list narrower than the set of names used by the web site.
Configure Dovecot mailbox access
Configure Dovecot’s mail location to match Postfix’s delivery format, for example maildir:~/Maildir. Create real system or virtual-mailbox accounts according to your chosen design, assign strong passwords, and verify that each account has a mailbox directory. Disable protocols you do not intend to support; offering IMAP over TLS on 993 is usually simpler than exposing unencrypted IMAP on 143.
Free tools Windows power users keep installed
One-click scans. No signup required.
If you enable POP3, decide whether users need it and enforce TLS. POP3 downloads mail rather than maintaining the synchronized folder model users expect from IMAP, so leaving it disabled reduces attack surface when it is unnecessary.
Connect Postfix SMTP authentication to Dovecot SASL
Authenticated submission should use Dovecot’s SASL socket. The Postfix settings commonly include:
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_tls_auth_only = yesConfigure the matching Dovecot authentication socket under the Postfix service directory and ensure the Postfix process can access it. The exact Dovecot include file varies by Ubuntu release, so confirm the active configuration with doveconf -n rather than assuming an old path.
Separate server-to-server SMTP from user submission
Keep TCP 25 for mail-server-to-mail-server traffic. Offer authenticated client submission on TCP 587, with TLS required before accepting credentials. Port 465 can be enabled for implicit TLS if your clients require it, but do not enable multiple submission paths without documenting and monitoring each one.
Recommended Free Tools
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
On the submission service, require authentication and reject unauthenticated relay attempts. A recipient restriction set should include the equivalent of:
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destinationreject_unauth_destination is essential: it prevents your server from relaying messages to arbitrary domains for unauthenticated callers. Never use a broad permit rule above it unless you understand exactly which networks or users are trusted.
Enable TLS and protect credentials
Use a certificate whose names cover mail.example.com and every hostname clients are instructed to use. Require TLS on submission and mailbox access. For inbound SMTP on TCP 25, opportunistic TLS is normal because the remote server may not support encryption; do not assume that opportunistic SMTP TLS provides end-to-end encryption for every message.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use strong, unique mailbox passwords, rate-limit repeated authentication failures where your tooling supports it, and disable unused accounts promptly. Monitor failed logins and sudden changes in outbound volume. A stolen password can turn a correctly configured server into a source of spam without any firewall rule being changed.
Publish the DNS records
Create the records in the authoritative DNS zone and check them from a network outside the VPS provider. The exact TTL is an operational choice, but lower TTLs are useful while migrating and can be raised after the configuration is stable.
| Record | Example value | Purpose and constraints |
|---|---|---|
| A | example.com. IN A <web-IPv4> |
Sends the website’s IPv4 traffic to the web VPS. |
| AAAA | example.com. IN AAAA <web-IPv6> |
Publish only when IPv6 routing, firewalling and service binding work. |
| A/AAAA | mail.example.com. IN A <mail-IPv4> and optional AAAA |
Resolves the mail hostname to the mail VPS. |
| MX | example.com. IN MX 10 mail.example.com. |
Points mail delivery to a hostname, never directly to an IP address. |
| PTR | <mail-IPv4> reverse-resolves to mail.example.com. |
Set at the VPS provider; forward and reverse names should agree. |
| SPF TXT | example.com. IN TXT "v=spf1 mx -all" |
Use only if every legitimate sender is represented by the domain’s MX; add authorized senders when your design requires them. |
| DKIM TXT | selector1._domainkey.example.com. with the public key |
Publish the key generated by your signing service and sign outgoing mail with the same selector. |
| DMARC TXT | _dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]" |
Start with a monitoring policy while validating SPF/DKIM alignment, then tighten the policy when reports show legitimate mail passes. |
The SPF example is appropriate only when the mail VPS is the complete authorized sending path. If an application, relay or other service also sends mail, include that sender explicitly rather than publishing an inaccurate -all policy. DKIM and DMARC syntax depends on the signer and reporting address; generate the key and record from the software you actually deploy.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
After DNS changes, query each record externally:
dig MX example.com
dig A mail.example.com
dig TXT example.com
dig TXT _dmarc.example.comIssue certificates and automate renewal
Use an ACME client such as Certbot for the web and mail hostnames. The web server certificate must cover every public website name; the mail certificate must cover the name entered by mail clients and presented by Postfix and Dovecot.
For nginx, the distribution plugin can obtain and install a certificate after the DNS record and HTTP virtual host are working. Certificate files are commonly exposed under /etc/letsencrypt/live/<hostname>/. Restrict private-key permissions and point Postfix and Dovecot at the active certificate and key paths rather than copying keys into multiple directories.
sudo certbot renew --dry-runUbuntu documents an automatic renewal timer. A successful dry run confirms that the renewal challenge can complete, but services may continue using the old certificate until they reload. Add a deploy hook that reloads nginx, Postfix and Dovecot after a successful renewal, then test the hook with a controlled renewal procedure. Check that the certificate’s subject names match the exact DNS names used by clients.
Operators who choose authenticated MTA-to-MTA delivery with DNSSEC and TLSA must publish TLSA records that match the MX hostname, certificate chain and rollover method. TLSA is optional and adds operational obligations; an incorrect record can make validating senders reject mail.
Test every path before launch
- Verify DNS from outside. Check A, AAAA, MX, PTR, SPF, DKIM and DMARC. Confirm the MX target resolves to the mail VPS and that the web names resolve only to the web VPS.
- Check HTTPS. Request the site over HTTPS and inspect the certificate name, expiration and redirect behavior. Confirm that the application is not exposing configuration files or directory listings.
- Check SMTP reachability. From an external network, verify that TCP 25 reaches the mail VPS and that the server announces the intended hostname. If the connection times out, investigate provider policy and firewall rules before changing Postfix.
- Check authenticated submission. Configure a test mail client for the mail hostname, TCP 587, TLS and a valid mailbox credential. Confirm that unauthenticated submission is rejected and authenticated mail is accepted.
- Check mailbox access. Test IMAP over TLS on 993, or POP3 over TLS on 995 if you intentionally enabled POP3. Log in, send a message to the mailbox, create a folder and verify that the message is visible after reconnecting.
- Check inbound delivery. Send from an unrelated external account to the domain. Inspect the Postfix log and mailbox, then confirm that the received message has the expected SPF, DKIM and DMARC results.
- Check outbound delivery. Send to an unrelated external account and inspect its headers. Verify that the sending IP, PTR name, DKIM signature and envelope domain are correct.
- Check queue behavior. Run
postqueue -pand confirm that normal messages leave the queue. A growing queue, repeated connection failures or deferred recipients requires investigation before production use. - Check the relay boundary. Attempt to submit to an unrelated domain without authentication from an external connection. The server must reject the request; an acceptance indicates an open-relay vulnerability.
- Check renewal. Run the ACME dry run, verify the deploy hook reloads all dependent services, and confirm that the new certificate is presented on HTTPS, submission and IMAP.
Keep test accounts separate from real users and remove temporary credentials after validation. Record the expected DNS names, ports and certificate paths so a future administrator can reproduce the checks.
Operate the servers independently
Backups and restoration
Back up web files, databases and application configuration separately from mailboxes, Postfix maps, Dovecot configuration and queue data. A website snapshot is not a mail backup. Encrypt off-host copies, restrict access to backup credentials and perform restoration tests on isolated instances. Test both a complete mailbox restoration and a single-message recovery.
Monitoring and abuse response
Monitor SMTP logs, rejected recipients, deferred messages, queue age, disk usage, certificate expiry and authentication failures. Alert on sudden outbound-volume increases and repeated login failures. Set sensible per-account or per-IP limits where your mail software supports them. If an account is compromised, disable or reset it immediately, stop the queue if necessary, remove malicious messages and inspect logs for persistence.
Provider restrictions and relay alternatives
Direct delivery requires ongoing reputation and policy work. If the provider blocks TCP 25, will not set reverse DNS, or cannot provide a usable abuse-response process, route outbound mail through an SMTP relay while retaining the mail VPS for mailbox storage and client access. In that model, update SPF and DKIM to represent the relay, and ensure Postfix permits relay submission only from authenticated users or explicitly trusted systems.
Troubleshoot by symptom
| Symptom | Likely cause | Actions |
|---|---|---|
| The website resolves to the wrong host | Stale A/AAAA data, an unintended DNS record or a proxy configuration. | Query the authoritative zone and an external resolver; remove conflicting records and verify both IPv4 and IPv6. |
| Senders cannot find the mail server | Missing MX record or an MX hostname without A/AAAA resolution. | Query MX and the target hostname. Keep the MX target as a resolvable hostname, not an IP literal. |
| Inbound SMTP times out | Provider port-25 restriction, firewall denial or Postfix not listening. | Check provider policy, firewall counters and the listening sockets; do not weaken recipient restrictions to fix a network problem. |
| Outbound mail is deferred | PTR mismatch, reputation issue, remote rejection or an unreachable destination. | Read the Postfix defer reason, verify PTR and forward DNS, inspect the queue age and address the remote policy response. |
| Users can send without logging in | Overly broad relay permissions or an incorrectly ordered recipient restriction. | Restore authenticated-only submission, keep reject_unauth_destination, reload Postfix and retest from outside. |
| Mail clients report certificate warnings | The certificate lacks the hostname configured in the client, is expired or was not reloaded. | Inspect the presented certificate on the exact port, run the renewal dry run and reload the affected service. |
| IMAP login succeeds but no mail appears | Postfix and Dovecot use different mailbox locations or permissions. | Compare home_mailbox with Dovecot’s mail_location, inspect ownership and review delivery logs. |
| Messages leave but fail authentication checks | SPF does not authorize the sender, DKIM signing is absent or DMARC alignment fails. | Compare the envelope sender, visible From domain, signing selector and published TXT records; update the policy only after legitimate senders pass. |
Final launch checklist
- Both VPS hosts have separate administrators, SSH keys, firewalls, update schedules and backups.
- The web A/AAAA records point only to the web VPS.
mail.example.comresolves only to the mail VPS, and its PTR points back to the same name.- The domain MX points to
mail.example.com, never to an IP address. - SPF, DKIM and DMARC describe the actual sending path.
- Postfix accepts mail for intended domains, authenticates submission, and rejects unauthorized relay.
- Dovecot exposes only the mailbox protocols you need and requires TLS for client access.
- HTTPS, submission and mailbox certificates renew automatically and trigger service reloads.
- External tests cover inbound, outbound, authenticated and unauthenticated SMTP, mailbox access, queue behavior and recovery.
- You have a documented response for provider blocks, compromised accounts, full disks and failed certificate renewal.
Bottom line
Two VPS instances are a sound separation for a website and self-hosted email when each service has its own identity, firewall, credentials, queues, backups and monitoring. The decisive details are not the web-server package choice but the mail hostname, matching forward and reverse DNS, correct MX and authentication records, provider SMTP policy, TLS renewal and strict relay controls. Build and test those dependencies in order, and use an SMTP relay instead of forcing direct delivery when the provider or operational workload cannot support a trustworthy mail system.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
