Send Email from a New Server IP Without Landing in Spam: rDNS, SPF, DKIM, DMARC and IP Warm-Up

Mail sent from a brand-new server IP often lands in spam or is rejected outright, even when the message is perfectly legitimate. Mailbox providers judge a new IP by its technical setup first and by its sending behaviour over the following weeks. This guide covers the checklist that decides whether your mail is accepted: outbound port 25, reverse DNS, SPF, DKIM and DMARC, TLS, the Gmail and Yahoo sender requirements, how to warm up a new IP, and how to test the result. To run a complete mail server, see also running your own mail server with Mailcow or Postal.

Step 1: Check That Outbound Port 25 Works

Many providers block outbound port 25 by default to stop spam. Test from the server:

# Should print "Connected" or an SMTP banner starting with 220
nc -vz -w 5 gmail-smtp-in.l.google.com 25
timeout 5 bash -c 'cat < /dev/tcp/gmail-smtp-in.l.google.com/25' | head -1

If the connection times out, outbound SMTP is blocked on your service; open a support ticket and explain what you will send.

Step 2: Set Reverse DNS and the Hostname

The IP's PTR record should resolve to your mail hostname, and that hostname's A record should point back to the same IP (forward-confirmed reverse DNS). The server should also greet other mail servers (HELO/EHLO) with that hostname.

dig -x 203.0.113.10 +short          # expect: mail.example.com.
dig mail.example.com A +short        # expect: 203.0.113.10
hostnamectl set-hostname mail.example.com
postconf -e 'myhostname = mail.example.com'   # if you use Postfix

Reverse DNS is set by the owner of the IP block; see setting up rDNS / PTR records.

Step 3: Publish SPF

SPF lists the servers allowed to send mail for your domain. Publish one TXT record on the domain:

example.com.   TXT   "v=spf1 ip4:203.0.113.10 -all"

# If you also send through another service, include it in the same single record, e.g.
# "v=spf1 ip4:203.0.113.10 include:_spf.example-mailservice.com -all"

dig TXT example.com +short

Only one SPF record per domain is allowed; two records make SPF fail.

Step 4: Sign Mail with DKIM

DKIM adds a cryptographic signature to every message. Most mail suites (Mailcow, iRedMail, Mail-in-a-Box) generate the key for you; with Postfix and OpenDKIM:

apt install -y opendkim opendkim-tools
mkdir -p /etc/opendkim/keys/example.com
opendkim-genkey -b 2048 -d example.com -s mail -D /etc/opendkim/keys/example.com/
chown -R opendkim:opendkim /etc/opendkim/keys
cat /etc/opendkim/keys/example.com/mail.txt     # the DNS record to publish

# After publishing mail._domainkey.example.com TXT "v=DKIM1; k=rsa; p=..." check it:
dig TXT mail._domainkey.example.com +short

Then connect OpenDKIM to Postfix as a milter according to your distribution's documentation, and confirm that sent messages carry a DKIM-Signature header.

Step 5: Publish DMARC

DMARC tells receivers what to do when SPF and DKIM do not align with the From domain, and sends you reports. Start in monitoring mode and tighten it once the reports look clean.

_dmarc.example.com.   TXT   "v=DMARC1; p=none; rua=mailto:[email protected]"

# Later, when legitimate mail passes consistently:
# "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
# "v=DMARC1; p=reject; rua=mailto:[email protected]"

Step 6: Meet the Gmail and Yahoo Requirements

Since 2024, Gmail and Yahoo require all senders to have valid SPF or DKIM, forward-confirmed reverse DNS and TLS, and keep spam complaint rates low. Bulk senders (around 5,000 or more messages a day to Gmail) must additionally have SPF and DKIM, a DMARC record, an aligned From domain, and one-click unsubscribe for marketing mail. Use a valid TLS certificate on your mail server (see free SSL with Certbot or acme.sh) so that connections are encrypted.

Step 7: Warm Up the New IP

A new IP has no reputation. Large volumes from it on the first day look like a spam run. Increase volume gradually and send first to the recipients most likely to open and reply.

Register your domain in Google Postmaster Tools and your IP in Microsoft SNDS to see how these providers rate your traffic.

Step 8: Test and Monitor

• Send a message to a test service such as mail-tester.com; it scores SPF, DKIM, DMARC, rDNS, blacklists and content.
• Send to your own Gmail and Outlook addresses and open Show original: the Authentication-Results header must show spf=pass, dkim=pass and dmarc=pass.
• Check the IP on blacklists regularly (see IP blacklist checks) and read the DMARC reports.

FAQ

Everything passes but Gmail still puts my mail in spam

Then reputation and content are the issue. Slow down, send only to engaged recipients, remove addresses that bounce, avoid link shorteners and image-only messages, and give the IP and domain a few weeks to build a history.

Should I use a separate IP for marketing mail?

Yes, if you send both. Keeping transactional mail (password resets, invoices) on its own IP and domain or subdomain protects it from the reputation of marketing campaigns.

Is it easier to use an email delivery service?

For large volumes, often yes. You can still run your applications on your own server and relay mail through a reputable delivery service, which handles IP reputation for you.

Still stuck after following these steps? Open a support ticket and the IMIDC 24/7 technical team will help. Include the server IP, your mail hostname and domain, the result of the port 25 test and the full bounce message or test report so we can pinpoint the issue faster.