How to authenticate mail from a custom or self-hosted server

View as Markdown

On this page, we provide instructions on how to authenticate mail sent from your own mail server or application without relying on a third-party service like Google or Microsoft.

This applies to setups such as:

Mail servers: Postfix, Sendmail, Exim
Self-hosted suites: Mailcow, Mail-in-a-Box, Stalwart
Direct application mail: Web servers sending via PHP mail(), Python, Node.js, or cron scripts
On-premises infrastructure: Microsoft Exchange server, internal relays, and network appliances

Here is how to set up DKIM, SPF, and DMARC for your own server.

Allow list your server IP addresses in SPF

Find your server’s public IPv4 (and IPv6, if supported) address, and add it using the ip4 or ip6 mechanism like so:

Text

v=spf1 ip4:86.54.11.1 ip6:2a13:1001::86:54:11:1 ~all

If your mail server both sends and receives mail you can allow list your receiving server to send mail as well without repeating IP addresses in DNS:

Text

v=spf1 mx ~all

Set up DKIM signing on your server

DKIM works with key pairs: your mail server holds a private key to cryptographically sign outgoing messages, and you publish the corresponding public key in a TXT record at <selector>._domainkey.example.com so inbox providers can verify that signature. The selector acts as an identifier to differentiate between multiple DKIM key pairs.

Because every mail server handles key generation and signing differently, refer to the setup steps for your specific software.

Set up DKIM with Postfix and Sendmail

Postfix and Sendmail don’t sign DKIM keys natively. Use a milter (mail filter) to handle key generation, signing, and DNS record formatting:

Rspamd (recommended for modern setups)
OpenDKIM

Set up DKIM with Mailcow, Stalwart, or Mail-in-a-Box

Use the admin interface or CLI tool to generate the key pair and retrieve the exact DNS TXT records to publish.

Set up DKIM with Exim or application libraries

If you use Exim or send mail directly from code libraries (like PHPMailer or Nodemailer), you provide your own key pair:

Generate an RSA key pair (using OpenSSL or your library’s built-in key generator).
Choose a selector (such as default) and provide the selector and private key in your code or Exim config.
Publish the public key in a DNS TXT record at <selector>._domainkey.example.com.

Align your domain for DMARC

For outgoing mail to be considered DMARC compliant, the header from domain must match:

The domain in your DKIM signature (d)
The domain in your envelope from used when your mail server sends mail via SMTP

Even if your server config looks right, real-world delivery can still run into subtle alignment issues. The only way to know for sure is to ask receiving providers for feedback using a monitoring DMARC record.

Text

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Set up reverse DNS

While not strictly part of DMARC, most receiving providers will reject or quarantine mail sent from servers without valid reverse DNS.

Forward-confirmed reverse DNS (FCrDNS) proves your server is who it claims to be:

Forward lookup: Your server’s hostname (such as mail.example.com) points to your server’s IP address via an A or AAAA record.
Reverse lookup: Your server’s IP address points back to that same hostname via a PTR record.

Because IP addresses belong to the network provider, you configure PTR records through your server hosting provider or ISP rather than your domain registrar. Look for “Reverse DNS” or “PTR” settings in your server provider’s control panel, and set the value to match your mail server’s fully qualified hostname (the same name your server uses in its HELO/EHLO greeting).