Open Port 25 Isn't Enough: Why Your Self-Hosted Email Still Goes to Spam

Q: Why does my self-hosted email go to spam even with port 25 open?

Port 25 is one of four requirements for email deliverability. The other three are: a clean IP address (not on DNS blacklists), a correctly configured PTR/rDNS record that matches your mail server's hostname, and properly set up SPF, DKIM, and DMARC authentication records. Most self-hosted email fails at IP reputation, not port configuration. Budget VPS providers that open port 25 by default (like RackNerd on ColoCrossing infrastructure) often have the worst IP reputation because the same openness that lets you send also lets spammers send.

Q: How do I check if my VPS IP is blacklisted?

Run your IP through MXToolbox Blacklist Check (mxtoolbox.com/blacklists.aspx), which tests against over 100 DNS-based blacklists. Also check Spamhaus (check.spamhaus.org) specifically, since it's the most influential list. Do this BEFORE configuring your mail server. If the IP is listed, request a new one from your provider or request delisting from the blacklist operator before sending any mail.

Q: Which VPS provider has the cleanest IPs for email?

Hetzner generally has the cleanest IP reputation among budget-friendly providers, which is part of why they make you wait a month before opening port 25. The wait filters out throwaway spam accounts. Netcup's European IP ranges are also relatively clean. At the other end, RackNerd's ColoCrossing infrastructure has persistent IP reputation problems. The providers with the easiest port 25 access tend to have the worst IPs, because the same openness attracts abuse.

Q: What changed with Gmail's sender requirements in 2024?

Starting February 1, 2024, Gmail requires all senders to have SPF or DKIM authentication, valid PTR records, TLS connections, and spam rates below 0.3% in Google Postmaster Tools. Bulk senders (5,000+ messages per day to Gmail) must additionally have both SPF and DKIM, DMARC authentication, and one-click unsubscribe. Starting November 2025, Gmail began actively rejecting non-compliant messages rather than just flagging them. These rules apply to everyone sending to Gmail addresses, including self-hosted mail servers.

By Nate Corwin · Updated 2026 · self-hosting practitioner since 2017

Affiliate disclosure: some provider links below are affiliate links. This guide is built from public documentation, community experience, and first-hand self-hosting.

Every guide to self-hosted email starts with "find a VPS that doesn't block port 25." That's correct but incomplete, like saying the first step to driving cross-country is "get a car that starts." You got port 25 open. You installed Postfix or Mail-in-a-Box. You sent a test email to your Gmail. It landed in spam. Or it bounced with a 550 rejection. Or it vanished entirely. The port was never the hard part. The hard part is the three gates after it.

The four gates of self-hosted email deliverability: 1) Port 25 access (solved by choosing the right provider). 2) Clean IP reputation. 3) Correct PTR/rDNS record. 4) SPF, DKIM, and DMARC authentication. Most failures happen at gate 2. The cheapest "port 25 open" providers tend to have the dirtiest IPs, which is the core trade-off of self-hosted email.

Gate 1: Port 25 (the easy one)

This is the one everyone writes about. Your VPS needs outbound access on TCP port 25 to deliver mail directly to other mail servers. Some providers open it by default (RackNerd, Contabo, DartNode). Others require a support ticket or control-panel change (Hetzner, Vultr, BuyVM, Netcup). Some block it with no practical path to open (DigitalOcean, Oracle Cloud, AWS).

The port 25 policy map covers this in detail. If you haven't checked your provider yet, start there.

But here's the part the "port 25 open" guides skip: solving gate 1 while ignoring gates 2-4 doesn't just give you partial email. It gives you email that actively damages your domain reputation by sending into spam folders or getting rejected, which makes future emails from your domain harder to deliver even after you fix everything else.

Gate 2: IP reputation (the real killer)

This is where most self-hosted email fails, and where the choice of VPS provider matters more than anything you configure on the server itself.

Every IP address has a reputation with major email providers (Gmail, Outlook, Yahoo) and with DNS-based blacklists (Spamhaus, UCEProtect, Barracuda, SpamRATS). If the IP address assigned to your VPS was previously used for spam, or if it belongs to a network range that's broadly flagged, your perfectly configured mail server will have its messages rejected or spam-foldered before the content is even evaluated.

The problem is structural at some providers. RackNerd runs on ColoCrossing infrastructure. ColoCrossing's IP ranges have a persistent reputation problem because the same "port 25 open, no questions asked" policy that attracts legitimate self-hosters also attracts bulk spammers. Scamalytics assigns ColoCrossing a fraud score of roughly 41 out of 100, meaning close to half their visible web traffic is suspected to be potentially fraudulent. Individual IPs within ColoCrossing may not appear on popular blocklists, but some organizations block the entire ASN regardless.

This creates a paradox: the provider with the cheapest, most accessible port-25-open VPS (RackNerd at $11/year) also has some of the worst IP reputation for email. You can get port 25 for almost nothing, but what arrives through it gets treated as spam.

How to check before you send a single email

Before configuring your mail server, before installing Postfix, before touching a DNS record:

Run your VPS IP through MXToolbox Blacklist Check. It tests against 100+ DNS blacklists.
Check Spamhaus separately. It's the single most influential blacklist, and some providers block based on Spamhaus alone.
If the IP is listed, request a new IP from your provider. Most will swap it. If the new one is also listed, you have a provider-level reputation problem and should consider a different host.

Gate 3: PTR / rDNS

Your VPS IP address needs a reverse DNS (PTR) record that resolves to your mail server's hostname, and that hostname needs to resolve forward (A record) to the same IP. This is called forward-confirmed reverse DNS (FCrDNS), and many receiving servers check it. Gmail's sender guidelines list valid PTR records as a requirement for all senders.

Example of a correct setup:

VPS IP: 203.0.113.42
PTR record for 203.0.113.42 resolves to: mail.yourdomain.com
A record for mail.yourdomain.com resolves to: 203.0.113.42

If either direction doesn't match, or if the PTR is set to a generic hostname like vps12345.provider.com, some mail servers will reject your email outright.

Most VPS providers let you set PTR records through their control panel (Hetzner, Vultr, DigitalOcean, Contabo, Linode all do). RackNerd and BuyVM also support it. Netcup sets it automatically based on your server's hostname. The process varies but the requirement is universal. If your provider doesn't let you set PTR records, you can't reliably run a mail server there.

Gate 4: SPF, DKIM, DMARC

These are DNS records you configure on your domain. They tell receiving servers which IP addresses are authorized to send on your behalf (SPF), prove the message wasn't altered in transit (DKIM), and specify what to do with messages that fail either check (DMARC).

What changed in February 2024

Google's sender requirements, effective February 1, 2024, made these non-optional for anyone sending to Gmail addresses. The requirements apply to all senders, not just bulk senders:

SPF or DKIM authentication (required)
Valid PTR records (required)
TLS connection (required)
Spam rate below 0.3% in Google Postmaster Tools

For bulk senders (5,000+ messages per day to Gmail), the bar is higher: both SPF and DKIM are required, plus DMARC with at least p=none, plus one-click unsubscribe headers.

Starting November 2025, Gmail began actively rejecting non-compliant messages rather than just flagging them. Before this, you might get through with missing DKIM and just land in spam. Now the message bounces.

The practical effect for self-hosters: if you're sending to anyone with a Gmail address (and statistically, you are), all three records need to be right. Tools like Mail-in-a-Box and Mailcow handle this automatically during setup. If you're configuring Postfix manually, check your setup with mail-tester.com (send a test email, get a scored report).

The trade-off nobody says out loud

The four gates create a sorting problem with no perfect answer:

Provider	Port 25	IP reputation	PTR support	The catch
RackNerd	Open	Poor (ColoCrossing ASN)	Yes	Cheapest access, worst deliverability odds
Contabo	Open (25/min)	Moderate	Yes	Rate limit, variable CPU for SpamAssassin
DartNode	Open	Moderate (auto-disables on blacklist)	Yes	Newer provider, limited track record
Hetzner	On request (~1mo)	Good (cleanest budget range)	Yes	Month wait, support request, not instant
Netcup	Self-service firewall	Good (European ASN)	Yes	12-month commitment, smaller community
BuyVM	Support ticket	Moderate-good	Yes	Stock scarcity, support delays

The pattern is consistent: the easier the port 25 access, the worse the IP reputation tends to be. Providers that make you wait or apply for access have cleaner IP ranges precisely because the friction filters out spammers. This isn't a coincidence. It's the mechanism.

For self-hosted email that actually reaches inboxes, Hetzner's one-month wait is the price of a clean start. Contabo is the middle path if you check (and swap if needed) your IP on day one. RackNerd works if you get lucky with the IP lottery, but the odds are against you.

Pre-send checklist

Run through this before sending your first real email. Every item here has prevented a specific deliverability failure I've encountered or seen reported in r/selfhosted.

Check IP on Spamhaus + MXToolbox. If listed, swap the IP or switch providers before configuring anything else.
Set PTR record in your VPS control panel to match your mail hostname (e.g. mail.yourdomain.com).
Verify FCrDNS: dig -x YOUR_IP returns your mail hostname, and dig A mail.yourdomain.com returns your IP.
Configure SPF (TXT record: v=spf1 ip4:YOUR_IP -all).
Configure DKIM (generate key pair, add public key as TXT record, sign outgoing mail).
Configure DMARC (TXT record: at minimum v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com).
Test with mail-tester.com. Send a test email to the address they give you. Aim for 9/10 or higher.
Send a test to Gmail and Outlook. Check that it arrives in inbox, not spam. Check the message headers for authentication results.
Register with Google Postmaster Tools. This lets you monitor your domain's spam rate at Google, which must stay below 0.3%.

FAQ

Why does my self-hosted email go to spam even with port 25 open?

Port 25 is one of four requirements. The other three: a clean IP (not on blacklists), a correct PTR/rDNS record, and properly configured SPF/DKIM/DMARC authentication. Most failures happen at IP reputation. Budget VPS providers that open port 25 easily often have the worst IPs because the same openness attracts spammers.

How do I check if my VPS IP is blacklisted?

Run your IP through MXToolbox Blacklist Check (100+ blacklists) and Spamhaus specifically. Do this before configuring anything. If listed, request a new IP from your provider. If the replacement is also listed, consider a different provider.

Which VPS provider has the cleanest IPs for email?

Hetzner generally has the cleanest budget IP ranges, partly because the one-month wait for port 25 filters out throwaway spam accounts. Netcup's European ranges are also relatively clean. RackNerd's ColoCrossing infrastructure has persistent reputation problems. The providers with the easiest port 25 access tend to have the worst IPs.

What changed with Gmail's sender requirements in 2024?

Starting February 2024, all senders to Gmail must have SPF or DKIM, valid PTR records, and TLS. Bulk senders (5,000+/day) need both SPF and DKIM plus DMARC. Since November 2025, Gmail actively rejects non-compliant messages instead of just flagging them. These rules apply to self-hosted mail servers.