SPF, DKIM & DMARC for Multi-Domain VPS
Email deliverability is silent until it breaks. Here is the exact DNS setup I use to keep transactional email out of spam across multiple domains.
By Mussawar Hayat
Deliverability Is Infrastructure
Transactional email from a VPS fails quietly when SPF, DKIM, and DMARC are missing or inconsistent. Multi-domain hosts need careful DNS and aligned From domains. This is the setup I use for production mail on shared VPS environments.
What You Will Learn
- SPF records that authorize only your senders
- DKIM key generation and DNS publishing
- DMARC policies that start monitoring then enforce
- Alignment pitfalls with multiple domains
- Checklist before sending production mail
1. SPF
Publish a TXT record that lists only the IPs or includes you actually use. Avoid +all. Example: v=spf1 ip4:YOUR.IP -all or include your ESP.
2. DKIM
Generate a key pair on the mail host, configure the MTA to sign, and publish the public key as a TXT record under a selector (e.g. mail._domainkey). Rotate keys on a schedule.
3. DMARC
Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com to collect reports. Move to quarantine then reject once legitimate mail passes alignment.
4. Multi-Domain Notes
Each sending domain needs its own SPF/DKIM/DMARC. The visible From domain must align with DKIM/SPF for DMARC to pass. Shared IP reputation affects all domains on the box — monitor blacklists.
5. Production Checklist
- SPF hard fail (-all) with correct includes
- DKIM signing verified with external checkers
- DMARC rua mailbox monitored
- Reverse DNS (PTR) matches HELO name
- TLS for outbound submission
Summary
SPF, DKIM, and DMARC are not optional for transactional mail. Align domains, start DMARC in monitor mode, then enforce.
Key Takeaway
Authorize narrowly with SPF, sign with DKIM, and enforce with DMARC after you have clean reports.
Email from your VPS landing in spam?
I set up SPF, DKIM, DMARC, and mail stacks for multi-domain hosts. Get in touch.
Related guides
Ship a minimal, secure Next.js 16 App Router image with output: "standalone", multi-stage builds, non-root user, and only the files the runtime needs. Production Dockerfile, .dockerignore, and checklist.
Deploy Multi-Site Next.js on VPS with Nginx, PM2 & SSLRun multiple Next.js 16 apps on one VPS with Nginx reverse proxy, PM2 process management, Let's Encrypt SSL, and zero-downtime symlink deploys. Production directory layout, server blocks, ecosystem config, and checklist.
Grok Bot Explained: Persistent Cloud Agents, Shared Computers, and Production Guardrails (2026)Grok Bot gives AI teammates a persistent cloud computer with a browser, filesystem, and terminal. Here is what it is, how it differs from Cursor Cloud Agents and coding agents, and the production rules that keep always-on bots from becoming a liability.