Deliverability Is Infrastructure, Not a Plugin

Transactional email from a VPS fails quietly when SPF, DKIM, or DMARC are missing or misaligned. Password resets, invoices, and contact forms land in spam — or never arrive — while the application log still shows “sent.” Multi-domain hosts amplify the problem: each From domain needs its own authorization records, and a shared IP’s reputation affects every site on the box.

This guide documents the production setup used for multi-domain VPS mail: narrow SPF, working DKIM signatures, DMARC that starts in monitor mode and moves to enforce, plus reverse DNS and TLS requirements receivers actually check.

What You Will Learn

SPF records that authorize only your real senders
DKIM key generation, signing, and DNS publication
DMARC policies from p=none to p=reject with rua reporting
Alignment rules when several domains share one VPS
A pre-production checklist including PTR and TLS

1. SPF: Authorize Narrowly

SPF is a DNS TXT record that lists which hosts may send mail for a domain. Publish one SPF record per domain (multiple SPF TXT records are invalid).

Examples:

Mail only from this VPS: v=spf1 ip4:203.0.113.10 -all
VPS plus Google Workspace: v=spf1 ip4:203.0.113.10 include:_spf.google.com -all
ESP only (no local MTA): v=spf1 include:sendgrid.net -all

Use -all (hard fail) once you are sure the list is complete. Avoid +all. Prefer ~all only during short migration windows. Keep the record under the DNS 255-character string limit; split long include chains carefully or use a subdomain for bulk mail.

2. DKIM: Sign Every Message

DKIM attaches a cryptographic signature to outbound messages. Receivers verify the signature against a public key published in DNS.

Generate a 2048-bit RSA key pair on the mail host (OpenDKIM, rspamd, or your MTA’s built-in signer).
Configure the MTA to sign mail for each sending domain with a stable selector (e.g. mail or s1).
Publish the public key as TXT at selector._domainkey.example.com.
Verify with an external checker that signatures pass on a real test message.

Rotate keys on a schedule (for example every 12 months). Publish the new selector before switching signing, then remove the old DNS record after TTL expiry.

3. DMARC: Monitor, Then Enforce

DMARC tells receivers what to do when SPF or DKIM fail alignment with the visible From domain. Start with reporting only:

v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1

Review aggregate reports for a few weeks. Legitimate mail must pass SPF or DKIM alignment. Then move to:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com

Increase pct and eventually set p=reject when reports are clean. Without a monitored rua mailbox, you are flying blind.

4. Multi-Domain Alignment

Each sending domain needs its own SPF, DKIM, and DMARC records. DMARC alignment requires that the domain in the From header aligns with the domain that passed SPF and/or DKIM. Common failure mode: the envelope sender is on a shared mail subdomain while From is the customer domain and neither SPF nor DKIM aligns.

Shared IP reputation matters. One compromised form or open relay on the VPS can blacklist every domain. Monitor blocklists (Spamhaus and similar) and keep submission authenticated (SASL) so random processes cannot inject mail.

5. PTR, HELO, and TLS

Reverse DNS (PTR) for the sending IP should match a hostname you control; forward DNS for that hostname should resolve back to the same IP.
SMTP HELO/EHLO name should match that hostname.
Offer TLS for outbound submission and prefer TLS when delivering to remote MX hosts.
Use consistent From and Reply-To addresses that exist and accept bounces.

6. Production Checklist

Single SPF TXT per domain with -all and only real includes/IPs
DKIM signing verified end-to-end for each domain
DMARC rua monitored; policy progressing toward reject
PTR and HELO aligned
No open relay; submission requires auth
Bounce and complaint handling configured
Test with mail-tester or equivalent before cutting over production traffic

7. FAQ

Can one SPF record cover all domains on the VPS?

No. SPF is published per domain (or subdomain). Each From domain needs its own record.

Should I send app mail through an ESP instead?

Often yes for marketing volume. For low-volume transactional mail, a well-configured VPS is fine if SPF/DKIM/DMARC and IP reputation are maintained.

Why does Gmail still spam my mail?

Check alignment, content, sudden volume spikes, and whether the IP or domain is listed. DMARC pass alone does not guarantee inbox placement.

8. Summary

SPF authorizes senders, DKIM proves integrity, and DMARC enforces alignment policy. On a multi-domain VPS, configure all three per domain, align PTR/HELO, and only then trust transactional mail to reach the inbox.

Key Takeaway

Authorize narrowly with SPF, sign with DKIM, monitor then enforce with DMARC, and keep PTR, HELO, and TLS consistent with the domains you send as.

Email from your VPS landing in spam?

I set up SPF, DKIM, DMARC, and mail stacks for multi-domain hosts. Get in touch or see DevOps services.

Related reading: Deploy Multi-Site Next.js on VPS.

SPF, DKIM & DMARC for Multi-Domain VPS: Production Email Setup (2026)