Learn how to apply email-sending best practices on your dedicated server to prevent legitimate messages from being flagged as spam.
In general, anti-spam policies are strict. To ensure your emails reach recipients without being blocked by security tools, you will need to configure your service to authenticate your messages and their contents on the recipient servers that process them.
This tutorial is designed to help you as much as possible with common tasks. If you are having difficulty performing these actions, please contact a specialized service provider. OVHcloud can't provide you with technical support in this regard.
Requirements
- You must be an administrator or a configured email server
- You must be able to manage the DNS zone for the domain name(s) used for sending
Instructions
NOTE: Port 25 is not recommended due to encryption and authentication concerns, which result in many ISPs blocking that port. The best practice for secure email transmission is to use more secure ports, such as 465 and 587. See more below.
Configure the SPF record
If you are using a dedicated infrastructure (e.g., a dedicated server, VPS, Public or Private Cloud instance), the optimal SPF record is: v=spf1 ip4:server_ipv4 ~all. Please remember to replace ‘server_ipv4’ with your server’s IPv4 address.
The symbol before the all is very important:
-
+: accept -
-: do not accept -
~: soft fail -
?: neutral
You can configure the SPF record for a specific domain name or by using the IPv6 address. For further information on SPF registration, refer to the following page: http://www.open-spf.org/.
Configure the DKIM record
The DKIM (DomainKeys Identified Mail) record is used to sign emails to counter email spoofing. This signature works on the principle of a private/public key pair, allowing the sender domain to be authenticated.
The authentication is carried out by a DKIM key that needs to be added to your DNS zone. There are different generators for DKIM keys, including DKIMCore. Please follow the instructions listed on your chosen generator website.
Configure the DMARC record
DMARC (Domain-based Message Authentication, Reporting, and Compliance) is a security standard that relies on the two methods of SPF and DKIM email security. The arguments in the DMARC record guide the recipient on how to handle emails depending on the SPF and/or DKIM result. An email address can be defined in the DMARC record, which will receive a report on authentication failures.
Configure the reverse IP resolution
To further optimize email sending and lower the risk of your emails being blocked, you can also configure the reverse DNS path (PTR record) with your domain name.
To begin, create an A record in the DNS Zone of your domain with the IP address of your server as a target.
Once you have modified your domain name’s DNS zone, it can take up to 24 hours for the changes to propagate fully and be effective.
To configure the reverse DNS path in the OVHcloud Control Panel, please refer to our dedicated guide.
Specific types of email sending
To a Microsoft server (Outlook, etc.)
Microsoft uses a whitelist policy. This means that initially, everything starts on a blacklist, and a specific procedure is required to validate your email server.
Before starting the procedure to whitelist your IP, make sure you have a reverse IP configured.
Microsoft also checks the SPF record, so it is recommended that you configure it.
Next, you will need to sign the SNDS (Smart Network Data Services) and JMRP (Junk Mail Reporting Partner Program) contracts. To subscribe, create a free account here.
Once your account is created, you must fill in the following form:
- Company name
- Contact email address: (A valid email address where Microsoft can contact you.)
- Complaint feedback email address: (A valid email address where you will receive spam complaints. The best practices recommend the email to be in the form: abuse@mydomain.com.)
Next, add your IP addresses in the section IP address or range.
When clicking on Add new Network, you will be asked to choose a contact email to authorize the request. Enter the address abuse@mydomain.com (obviously replace it with your own address) previously defined to receive spam complaints.
Once the information is filled in, click Begin Setup to transmit the request. Microsoft will then send you an SNDS-JMRP Contract email and a second email to mydomain.com.
Once the confirmations are approved, the subscription to JMRP/SNDS will be completed.
Once this is done, and if your IP appears to be blocked, you can then request to delist it via the junk mail procedure (usually within 48 hours).
In some cases, Microsoft may ask for the date of the first billing of your IP/server. In this situation, you can send a copy of your bill and add your IP/server details (ex., host name ns1111111.ip-203-0-113.us) in your reply.
For additional information, please open a support request with Microsoft.
Refusal by Microsoft
Microsoft may refuse to delist your IP(s), in which case OVHcloud cannot intervene. It is important to respect the best practices of Microsoft.
To a Gmail server
Adding specific records, such as a Domain-based Message Authentication, Reporting, and Compliance (DMARC) or DomainKeys Identified Mail (DKIM) record, can make it easier to receive emails if your recipient is at Gmail. Google's Add a DMARC record article may help you with this.
Blocked SMTP port (port 25)
If emails are not sending or SMTP is not responding, a blocked port is a common cause. By default, outgoing port 25 is blocked on OVHcloud infrastructure (dedicated servers, VPS, Public Cloud instances) to prevent spam abuse. To resolve this:
- Use port 587 (STARTTLS) for outbound mail submission.
- If your use case requires port 25, request it to be unblocked by contacting our support team.
Check your information
You may want to use a website like Mail Tester to check that all of your settings are correct.
Go further
For more information and tutorials, please see our other Dedicated Servers support guides or explore the guides for other OVHcloud products and services.