Operations

Configure a clean dedicated IP for an SMTP VPS on AlmaLinux

BM BizMaC Team Aug 20, 2026 9 min read

You bought an SMTP VPS in Vietnam, the provider handed you a dedicated IP, and your first test campaign still lands in spam. The IP itself was never the problem. What is missing is the configuration around it: rDNS, SPF, DKIM, DMARC, and a sending pattern that does not trip spam filters. This guide walks through each step on AlmaLinux 9, the exact commands, and the verification checks that prove the setup works before you send a single real email.

Prerequisites

  • An AlmaLinux 9 VPS with a dedicated IPv4 and full root access over SSH.
  • A domain name you control, with DNS management at your registrar or a DNS provider.
  • The IP must not be shared with other senders. A clean dedicated IP for SMTP means you alone control the sender reputation.
  • A mail server already installed. This guide covers Postfix plus OpenDKIM, the most common stack on AlmaLinux.

Why a clean dedicated IP matters for SMTP in Vietnam

When you rent a VPS with a shared IP, you inherit the reputation of everyone else on that address. One spammer on the same IP gets it blacklisted, and your legitimate mail suffers. A dedicated IP isolates your sender reputation, but isolation alone does not make it clean. The address must have no history of spam, which is why providers sell IPs from fresh ranges, and it must be configured correctly from day one.

For outbound mail from Vietnam, the local route matters. A SMTP VPS in a Vietnamese datacenter gives you a local IPv4 for the session, which helps when recipients filter on geographic origin. But the technical records decide deliverability, not the location. rDNS, SPF, DKIM and DMARC are what mailbox providers check first.

Step 1: Verify the IP and its current reputation

Before configuring anything, check what the IP looks like right now. You need the exact address assigned to the VPS:

ip -4 addr show | grep inet
hostname -I

Note the IPv4 address. Then check its history with a few public tools:

dig -x YOUR_IP +short
curl -s https://api.hackertarget.com/reversedns/?q=YOUR_IP

VERIFY: the reverse DNS query should return either nothing or a generic PTR record. If it returns a domain that looks spammy, or if the IP appears in any blacklist, contact the provider and ask for a different address before sending mail. A clean IP starts with no history.

Step 2: Set up rDNS (PTR record)

The PTR record maps the IP back to a hostname, and it must match the hostname your mail server uses in the EHLO greeting. This is the single most common miss on self-managed SMTP servers.

Pick a hostname like mail.yourdomain.com and set the server hostname:

hostnamectl set-hostname mail.yourdomain.com
postconf -e "myhostname = mail.yourdomain.com"

On most VPS providers you set the PTR record in the control panel, not on the server itself. At thueVPS, open a ticket with the hostname you want and the support team sets the rDNS on the network side. If you manage your own DNS at a registrar, add a PTR record there, but the authoritative reverse zone for a provider-owned IP usually sits with the provider.

Verify the record propagates:

dig -x YOUR_IP +short
# Expected output: mail.yourdomain.com.

Step 3: Configure SPF

SPF tells receiving servers which IPs are allowed to send mail for your domain. Add a TXT record at the root of your domain:

v=spf1 ip4:YOUR_IP -all

The ip4:YOUR_IP mechanism authorizes your dedicated IPv4. The -all at the end is a hard fail, which is correct for a single-server setup. Avoid the common mistake of adding ~all (soft fail) because many filters treat it as a warning and still spam-score the message.

If you use a third-party service like Google Workspace or Mailchimp alongside your SMTP server, include their SPF include statements before the -all:

v=spf1 ip4:YOUR_IP include:_spf.google.com -all

VERIFY:

dig TXT yourdomain.com +short
# Expected output: "v=spf1 ip4:YOUR_IP -all"

SPF alone gives you a pass on the envelope, but not on the content. That needs DKIM.

Step 4: Set up DKIM with OpenDKIM

DKIM signs the message body and headers cryptographically. Receiving servers verify the signature against a public key published in DNS. Install and configure OpenDKIM on AlmaLinux 9:

dnf install opendkim -y

Generate a key pair for your domain. Use a selector name like mail:

opendkim-genkey -s mail -d yourdomain.com -b 2048 -D /etc/opendkim/keys
chown -R opendkim:opendkim /etc/opendkim/keys

Edit /etc/opendkim.conf and set these values:

Mode                sv
KeyFile             /etc/opendkim/keys/mail.private
Selector            mail
Canonicalization    relaxed/simple
Socket              inet:8891@localhost

Then list the domain in the signing table and key table. Create /etc/opendkim/SigningTable:

*@yourdomain.com    mail._domainkey.yourdomain.com

Create /etc/opendkim/KeyTable:

mail._domainkey.yourdomain.com    yourdomain.com:mail:/etc/opendkim/keys/mail.private

Start and enable the service:

systemctl enable --now opendkim

Now wire Postfix to use it. Add these lines to /etc/postfix/main.cf:

milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

Reload Postfix and check the mail log:

systemctl reload postfix
journalctl -u postfix -n 20 | grep -i milter

The public key to publish in DNS is in /etc/opendkim/keys/mail.txt. Add it as a TXT record for mail._domainkey.yourdomain.com.

VERIFY:

dig TXT mail._domainkey.yourdomain.com +short
# Expected output: the long DKIM public key string

Step 5: Add DMARC

DMARC tells receivers what to do with mail that fails both SPF and DKIM. Publish a policy at _dmarc.yourdomain.com:

dig TXT _dmarc.yourdomain.com +short

You want output like:

"v=DMARC1; p=quarantine; rua=mailto:[email protected]; adkim=s; aspf=s"

Start with p=quarantine for the first two weeks, then tighten to p=reject once you see legitimate mail passing. The adkim=s and aspf=s flags request strict alignment, which means the domain in the From header must match the domain in SPF and DKIM. That is usually the right setting for a single-domain sender.

Step 6: Unblock port 25 and configure Postfix

Many VPS providers block outbound port 25 by default to stop spam. For a mail server, the port must be open both ways. Check with:

ss -tlnp | grep :25

If Postfix listens on port 25, the port is open. Test outbound connectivity to a well-known mail server:

timeout 5 bash -c 'echo | openssl s_client -connect gmail-smtp-in.l.google.com:25 -starttls smtp 2>/dev/null | grep "250"'

If the connection times out, the provider blocks outbound 25. At thueVPS, an SMTP VPS plan or a ticket to support opens the port on the dedicated IP. Do not try to tunnel mail through port 587 or 465 to work around the block, that breaks SPF alignment and gets you flagged as a hijacker.

Then set Postfix restrictions. Add to /etc/postfix/main.cf:

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

This prevents your server from becoming an open relay, which would get the IP blacklisted within hours.

Step 7: Warm up the IP and monitor reputation

A fresh dedicated IP has no reputation, which is nearly as bad as a bad one. Recips filter unknown IPs more aggressively. Start with low volume and increase gradually over 30 days:

# Week 1: 50-100 messages/day
# Week 2: 200-500 messages/day
# Week 3: 1,000-2,000 messages/day
# Week 4: scale to your target volume

Only send to engaged recipients. List hygiene matters more than volume. Bounces and spam complaints in the first weeks destroy the reputation you are trying to build.

Monitor blacklists daily. A simple check script:

for bl in zen.spamhaus.org bl.spamcop.net dnsbl.sorbs.net; do
  result=$(dig +short YOUR_IP.$bl)
  echo "$bl: ${result:-not listed}"
done

VERIFY: all three should print not listed. If any returns an IP, stop sending and investigate which of your records is misconfigured. The blacklist check guide has the full walkthrough.

Why does a new SMTP IP land in spam even with clean records?

This is the most common question on self-managed mail servers. The answer is almost always one of these three:

  1. Missing or mismatched rDNS. The PTR record does not match the EHLO hostname. Fix it at the provider.
  2. Weak DKIM alignment. The signing domain differs from the From domain, or the key is not published correctly. Check with opendkim-testkey.
  3. No warmup. A brand new IP sending 10,000 messages on day one always trips filters. Build volume gradually.

The good news: SPF, DKIM, DMARC and rDNS are checkable. Run this test after sending a test message to [email protected]:

# Request an autoreply and inspect the Authentication-Results header
# Expect: dkim=pass, spf=pass, dmarc=pass

Troubleshooting

Postfix does not sign with DKIM after configuration. Check the milter connection:

journalctl -u postfix | grep -i opendkim
# Fix: verify /etc/opendkim.conf Socket matches the milter line in main.cf

rDNS shows the wrong hostname. The provider controls the reverse zone for the IP. Open a ticket with the exact hostname, do not try to change it on the server. This is not a DNS record you can set yourself in most cases.

Port 25 is blocked. Run the openssl test above. If it times out, the outbound port is filtered. Request unblocking via the provider's support before changing any config.

FAQ

How long does it take to establish a good sender reputation on a new IP?

With a consistent warmup schedule and low complaint rates, most providers see reliable inbox placement within 4-6 weeks. The first two weeks are the most fragile, keep volume under a few hundred messages per day.

Can I use the same dedicated IP for multiple domains?

Yes, but each domain needs its own SPF record authorizing that IP, its own DKIM key, and its own DMARC policy. One DomainKeys selector can sign multiple domains, but separate keys make it easier to isolate a problem domain.

What is the difference between a clean IP and a warmed-up IP?

A clean IP has no blacklist history and is not associated with spam. A warmed-up IP has a positive sending history built through gradual volume increase. Clean is the starting state, warmed is the goal after 30-45 days.

Does a Vietnam-based SMTP VPS affect deliverability?

For recipients in Vietnam, a local IPv4 helps with geographic filtering and reduces connection latency. For international recipients, the technical records matter far more than the server location. A correctly configured IP from any datacenter performs well.

What should I check if my password reset emails go to spam from the dedicated IP?

Transactional mail failing authentication checks points to DKIM or SPF misalignment. Inspect the raw headers of a received message and look at the Authentication-Results line. It tells you exactly which of the three checks failed.

Related articles

SMTP专用IP配置与越南VPS合规要点

在AlmaLinux 9上配置SMTP专用IP，核心是四步：设置rDNS指向mail主机名、发布SPF记录授权该IPv4、配置DKIM签名并发布公钥、添加DMARC策略。新IP需要30天递增量热身，前两周每天控制在几百封以内，并每日检查黑名单。越南VPS的优势在于本地IPv4对越南用户的投递有地理优势，但国际投递仍取决于技术记录是否正确。购买前应与服务商确认端口25未屏蔽，并索要无历史记录的干净IP。

Note: This guide is for general reference. Every system and infrastructure has its own specifics, so test each step in a safe environment and consult a qualified engineer before applying it in production.