Sending mail is easy; getting it into inboxes is the hard part. A Postfix server that no one blocks needs three things: a clean forward/reverse DNS match, TLS, and SPF/DKIM records.

What you need: A VPS with a static IP, control of your DNS, and port 25 not blocked by the provider.

Install and pick your type

For a sending-only relay, choose “Internet Site” during dpkg-reconfigure. For a full server with local mailboxes, add Dovecot later.

Match your hostname and reverse DNS

Set myhostname to a name whose A record points at your server IP, and ask your host to set the PTR record to that same name.

Force TLS and authenticating clients

Enable SASL authentication on the submission port (587) and require TLS, so only your users can relay through the box.

Publish SPF and DKIM

Add an SPF TXT record for your domain and configure opendkim to sign outbound mail, then publish the DKIM public key.

apt install postfix opendkim opendkim-tools
postconf -e "myhostname = mail.example.com"
postconf -e "smtpd_tls_security_level = may"
systemctl restart postfix

How it works, in detail

Postfix only sends mail; the hard part is convincing receivers to accept it. That trust comes from three things: a forward and reverse DNS name that match, encryption on the submission port, and SPF/DKIM records that prove you are allowed to send for the domain. The reverse DNS record usually has to be set by your hosting provider, which is why it is worth confirming before you configure anything. Without DKIM signing, even perfectly formed mail looks anonymous to Google and Microsoft.

Delivery reputation is earned, not installed. DNS, TLS and DKIM together are the difference between “sent” and “delivered”.