Key takeaways
- Work through the causes in order: reverse DNS and HELO name, SPF, DKIM and DMARC, blocklists, then content and sending pattern.
- A new server address starts with no reputation, so send low volumes of wanted mail first and grow slowly.
- Hetzner and DigitalOcean block outbound mail ports by default (as of 30 October 2026), so check your provider's rules before you debug anything else.
- The headers of a delivered test message show exactly which check failed, so read them before changing settings.
Your server sends the message, the receiver accepts it, and it lands in spam. Or it never arrives at all. This is the most common complaint about running your own mail, and it nearly always has a boring cause. Work through the checks below in this order, because the earlier ones are the cheapest to fix and the most often wrong.
Step 1: read the headers of a delivered message
Send a test to a Gmail address you own, open the message, and choose "Show original". Look for the Authentication-Results lines:
spf=pass dkim=pass dmarc=pass
A fail, softfail, none or neutral tells you which of the next sections to read. If all three pass and the message is still in spam, the problem is reputation or content, covered further down.
Step 2: reverse DNS and the HELO name
Receivers look up the PTR record of your sending IP address and expect a real name, which in turn resolves back to the same address (forward confirmed reverse DNS). Google's sender guidelines list valid forward and reverse DNS as a requirement (checked 30 October 2026 at support.google.com/a/answer/81126). Check yours:
dig -x 203.0.113.10 +short
dig +short mail.example.com
The first command should print a name such as mail.example.com., and the second should print the same address. Your hosting provider sets the PTR record, usually in its control panel. Then make Postfix announce that same name with myhostname = mail.example.com in /etc/postfix/main.cf.
Step 3: SPF, DKIM and DMARC
If the header shows a failure here, fix it before anything else. The records, the 10 lookup limit and the staged DMARC policy are in SPF, DKIM and DMARC setup, step by step. Two checks specific to spam placement: the DKIM signature must cover the From header, and the signing domain should be your own domain, not your provider's.
Step 4: check blocklists
Look up your sending IP address and your domain:
- The Spamhaus reputation checker tells you whether the address or domain is on a Spamhaus list and gives the reason and the delisting steps.
- Gmail's Postmaster Tools shows domain and IP reputation and the spam rate for mail sent to Gmail, once you verify the domain.
If your address is listed, ask why before asking for removal. A listing on a new server often means the address range was used by someone else before you, or that your own server was used to send spam. Check that your server is not an open relay and that no account has a stolen password; the mail log (/var/log/mail.log) will show the sender.
Step 5: does your provider even allow port 25?
Many cloud providers block outbound mail ports to fight spam. As of 30 October 2026, from their own documentation:
- Hetzner blocks outbound ports 25 and 465 by default on all cloud servers. You can request an unblock through the limits page in the console after you have been a customer for a month and paid your first invoice; they decide case by case. Port 587 is not blocked (Hetzner cloud FAQ).
- DigitalOcean blocks SMTP ports 25, 465 and 587 on Droplets by default, and recommends a third party email service for sending (DigitalOcean documentation).
- OVHcloud: we could not open OVHcloud's page on the day of writing (the server refused our request), so check its current policy for your product yourself.
If port 25 is blocked, the symptom is a queue that never empties, not spam placement. Run postqueue -p and grep "Connection timed out" /var/log/mail.log. The usual workaround is to relay outgoing mail through a sending service on port 587 while keeping your own server for receiving.
Step 6: warm up and keep the volume steady
A new address has no history. Start with a few dozen real messages a day to people who will reply, increase gradually over several weeks, and avoid sending a large mailing on day one. Google asks bulk senders to keep the spam rate shown in Postmaster Tools below 0.30 percent and recommends staying below 0.10 percent. Mail that people mark as spam, move to junk or never open teaches the receiver that your address is unwanted.
Step 7: content and list hygiene
Once authentication and reputation are sound, look at the message itself: a real From name, a plain text part alongside HTML, no URL shorteners, no mismatch between link text and link target, a working unsubscribe for anything that is not one to one mail. For marketing mail Google requires one click unsubscribe. Remove addresses that bounce; a high bounce rate looks like a purchased list.
Test senders worth using
Send a message to the address a free mail tester gives you and read the score and the list of failed checks. Send it also to a Gmail, an Outlook and a Yahoo mailbox of your own and see which folder it lands in. Repeat after every change, one change at a time, so you know which one worked.
Which one should you pick
If everything passes and only one provider puts you in spam, work with that provider's tools and wait for the reputation to build. If authentication fails, fix that first. If your provider blocks port 25, stop debugging and relay. If you do not want to handle this at all, a panel that publishes the records and checks the server for you removes the most common causes (RespireCloud's mail feature does, though reputation and port rules stay yours). The wider background is in how to set up a mail server the right way and in how automatic wildcard SSL works, since a valid TLS certificate on the mail host is part of the same checklist.
Questions
Why does my mail go to spam only on Gmail or Outlook?
Each large provider keeps its own reputation for your address and domain. A message can pass at one and fail at another, so check Gmail with Postmaster Tools and send test messages to each provider you care about.
Does a new server IP address always start in spam?
Not always, but it has no history, and some address ranges are already listed because earlier customers abused them. Check the address on a blocklist lookup before you send.
Is it a problem if my reverse DNS does not match my mail domain?
The reverse DNS name should resolve back to the same address, and the HELO name your server announces should match it. It does not need to equal your From domain, but it must not be a generic provider name.
Should I just use a sending service instead?
For marketing volume, usually yes. For mail between people and a few system messages, your own server works once the checks below pass.
How long does it take to build a good reputation?
Usually several weeks of steady, wanted mail. There is no fixed number, so watch the spam rate and bounces rather than the calendar.
