Security

Setting Up a Secure SMTP VPS with Clean IP in Vietnam

BM BizMaC Team Aug 26, 2026 12 min read

You just bought a VPS in Vietnam, installed Postfix, and sent your first test email. It landed in spam. Most of the time this has nothing to do with your mail content, it comes down to the IP address you are sending from and the DNS records behind it. Setting up a secure SMTP VPS with clean IP in Vietnam means you treat the server as a dedicated email appliance: lock down the OS, claim your IP with proper DNS records, and build a sender reputation from zero. This guide walks through the whole chain on Debian 12, from picking the right plan to verifying your first campaign is actually deliverable.

Prerequisites

  • A VPS running Debian 12 (Ubuntu 24.04 or AlmaLinux 9 work too, adjust the package commands).
  • Root or a sudo user on the server.
  • A domain you control, with DNS management at your registrar or a DNS provider.
  • A dedicated IPv4 address assigned to the VPS. This is the key requirement for email, shared IPs are a gamble for sender reputation.
  • Port 25, 465 and 587 must not be blocked. Check with your provider before you start, some datacenters block outbound SMTP by default.

Why a Clean IP Decides Inbox Placement

A clean IP means the address has no history of spam, blacklisting, or abuse. Large email providers like Gmail, Outlook, and Yahoo build a reputation profile for every IP that sends them mail. A brand-new IPv4 starts neutral, which is good, but the moment that IP sends spam, or sits on a block previously used for abuse, your deliverability tanks and recovery takes weeks.

In Vietnam the situation is more specific. Many datacenters hand out IPs that were recycled from other tenants, and you never know what the previous user did with them. Before you configure anything, check your IP against common blacklists. If it is listed, do not start sending, ask your provider for a different address. Most serious providers, including SMTP VPS plans, let you verify and swap the IP before you commit to a long sending campaign.Linux VPS hosting with a dedicated IPv4 gives you full control over rDNS and DNS records, which is exactly what email requires.

干净的 IP 地址和正确的 DNS 记录是邮件进入收件箱的关键。

A clean IP address and correct DNS records are what determine whether your mail lands in the inbox.

Choose the Right VPS for SMTP

Email is lightweight, a 2 GB RAM VPS handles a few thousand messages a day without breaking a sweat. The real decision is about IP quality and network policy, not raw CPU. When you review VPS pricing and plans, look for these three things: a dedicated IPv4, outbound port 25 open, and the ability to set your own rDNS. A plan that blocks port 25 is useless for SMTP no matter how cheap it is.

RequirementWhy It MattersMinimum
Dedicated IPv4Your sender reputation is tied to this address alone1 IP, not shared
Outbound port 25Required to talk to other mail servers directlyUnblocked
rDNS controlPTR record must match your sending hostnameConfigurable in panel or via ticket
RAMPostfix + DKIM + logs run fine on small instances2 GB

You can rent a dedicated IP SMTP VPS in Vietnam with NVMe storage and full root access, which is what you want for mail. You also avoid the latency of routing through an offshore server when your recipients are in Vietnam, domestic delivery stays fast and local.

Check IP Reputation Before You Send

Do this before installing Postfix. Run these checks from your local machine or a web browser, they take two minutes and save you weeks of deliverability pain.

# Check DNSBLs (multi-check tools are faster)
dig +short your-server-ip.blacklist.com  # returns 127.0.0.x if listed

# Or use a web tool, check your IP against Spamhaus, Barracuda, SORBS
# https://mxtoolbox.com/blacklists

You also want to confirm your IP is not on a block previously used for bulk abuse. There is no public database for that, but if the blacklist check is clean and the IP is fresh, you are in a good starting position. As a rule, ask your provider how long the IP has been in production. A brand-new address with no history is the cleanest starting point you can get.

Set Up Postfix with Security in Mind

Now install Postfix and configure it as a sending-only server. You do not need a full mail server with IMAP and mailboxes for this task, you just need to relay mail out.

apt update
apt install postfix mailutils opendkim opendkim-tools

# During install choose "Internet Site" and set your main domain.

Edit the main configuration to restrict who can use the server. You do not want an open relay, that gets you blacklisted within hours.

nano /etc/postfix/main.cf
myhostname = mail.yourdomain.com
mydomain = yourdomain.com
myorigin = $mydomain
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, localhost
mynetworks = 127.0.0.0/8
smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination
smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination
smtp_tls_security_level = may
smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.yourdomain.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.yourdomain.com/privkey.pem

Restrict relays to localhost only. Your web application or script connects via localhost and Postfix sends the mail out. Nothing on the public internet can use your server to send spam. Verify with postconf -n and restart.

postconf -n | grep mynetworks
# output: mynetworks = 127.0.0.0/8
systemctl restart postfix
systemctl status postfix
# output: active (running)

Set Up SPF, DKIM, and DMARC DNS Records

These three records tell receiving servers that your mail is legitimately from your domain. Without them, Gmail and Outlook treat you as a spoofing risk and route you to spam or reject outright.

First, SPF. Add a TXT record at your DNS provider that lists your sending server.

TXT record at yourdomain.com:
v=spf1 ip4:YOUR_SERVER_IP -all

The -all at the end is strict and says only this IP may send for your domain. That is the correct setting for a dedicated sending server. Some guides recommend ~all for soft fail, but for a dedicated SMTP server, hard fail is right.

Second, DKIM. Generate a key pair and publish the public key.

opendkim-genkey -s mail -d yourdomain.com -b 2048 -D /etc/opendkim/keys/
# creates mail.private and mail.txt in /etc/opendkim/keys/
cat /etc/opendkim/keys/mail.txt

Publish the content of mail.txt as a TXT record for mail._domainkey.yourdomain.com. Do not modify the value, paste it verbatim. Then tell OpenDKIM which key to use.

echo "mail._domainkey.yourdomain.com yourdomain.com:mail:/etc/opendkim/keys/mail.private" >> /etc/opendkim/key.table
echo "*@yourdomain.com mail._domainkey.yourdomain.com" >> /etc/opendkim/signing.table
echo "mail._domainkey.yourdomain.com yourdomain.com:mail:/etc/opendkim/keys/mail.private" >> /etc/opendkim/trusted.hosts
systemctl restart opendkim

Third, DMARC. This tells receivers what to do with mail that fails SPF or DKIM. Start with a monitoring-only policy to see your traffic before enforcing.

TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:[email protected]; fo=1

Check all three records after publishing. They take up to an hour to propagate, but the syntax check works immediately.

dig TXT yourdomain.com +short
dig TXT mail._domainkey.yourdomain.com +short
dig TXT _dmarc.yourdomain.com +short

Set rDNS (PTR Record)

Receiving servers reverse-lookup your IP and expect the hostname to match the one in your HELO and your DNS. If your PTR says mail.yourdomain.com, your HELO must say the same.

Set this in your VPS control panel. On a dedicated IP SMTP VPS the provider usually offers rDNS management in the panel or via a quick ticket. The value must be mail.yourdomain.com, matching your Postfix myhostname exactly. Verify after it propagates.

dig -x YOUR_SERVER_IP +short
# output should be: mail.yourdomain.com.

This is the record people forget most often. You can have perfect SPF and DKIM, but if rDNS does not match, Gmail still flags you. It is a hard requirement for inbox delivery.

Harden the Server Against Abuse

A mail server on a public IP gets scanned constantly. Lock down SSH immediately so nobody guesses their way in and starts sending spam from your clean IP.

# Disable password auth, use keys only
nano /etc/ssh/sshd_config
# set: PasswordAuthentication no
# set: PermitRootLogin prohibit-password
systemctl restart sshd

# Install fail2ban to block repeated login attempts
apt install fail2ban
systemctl enable --now fail2ban

Then configure the firewall to allow only the ports you actually use.

# Allow SSH, HTTP/HTTPS for Let's Encrypt, and SMTP ports
nft add rule inet filter input tcp dport { 22, 80, 443, 25, 465, 587 } accept
nft add rule inet filter input ct state established,related accept
nft add rule inet filter input ct state invalid drop
nft add rule inet filter input iif lo accept
nft add rule inet filter input drop

If you use ufw instead of nftables, the equivalent is ufw allow 25/tcp and so on. Either way, the principle is the same: deny everything, allow only what mail and administration require. For a detailed walkthrough of common SSH lockdowns, see our SSH hardening guide.

Configure the Firewall and Verify Open Ports

After applying firewall rules, confirm the SMTP ports are actually reachable from outside. A silent drop is the worst failure mode because your logs show nothing.

ss -tlnp | grep -E ':(25|465|587)'
# output should show postfix listening on those ports

# From your local machine
nc -zv YOUR_SERVER_IP 25

If the connection is refused, check whether Postfix is running and whether the firewall is active. If it hangs, the firewall is dropping the packet. You also need to confirm the provider itself is not blocking port 25 at the network level, some datacenters do this without telling you. Send a test through the server and watch the mail logs.

Send a Test and Verify Headers

Now send a real test message and read the headers. This tells you whether all the DNS work actually translates into a passing authentication result.

echo "Test body" | mail -s "SPF DKIM test" [email protected]

Open the message in Gmail, click "Show original", and look for these three lines:

SPF: PASS with IP YOUR_SERVER_IP
DKIM: PASS with domain yourdomain.com
DMARC: PASS

If any of them says FAIL or SOFTFAIL, go back to the corresponding DNS record. The most common mistake is a typo in the DKIM TXT value, the quotes and semicolons must match exactly what opendkim-genkey generated. If DMARC fails because SPF or DKIM failed, fix the underlying record first, then re-check.

For your first real sending, keep volume low and gradual. A brand-new IP that suddenly sends 10,000 messages gets throttled or blocked. A reasonable schedule: 50 messages on day one, 150 on day two, 300 by day five, and only scale up after the first week if your bounce rate stays under 2%. See our 30-day IP warm-up schedule for a full plan.

Common Problems and How to Fix Them

Why does Gmail reject my mail with "421 4.7.0" errors?

This means your IP or domain has a reputation problem or is temporarily rate-limited. Check your IP on Spamhaus first. If clean, slow down your sending rate, Gmail limits new IPs aggressively. Also confirm your rDNS matches your HELO exactly.

SPF passes but DKIM fails, what did I break?

The DKIM TXT record is likely malformed. Check that you copied the full value without line breaks, DNS TXT records do not handle whitespace the way you expect. Regenerate with opendkim-genkey and republish if needed.

Can I send from a shared IP instead?

In theory yes, but you inherit the reputation of everyone else on that IP. One spammer on the same block ruins delivery for all of you. For any serious sending, a dedicated IPv4 on a clean IP SMTP VPS is the only reliable option.

My port 25 is unreachable even though Postfix runs, why?

Check two layers: your server firewall and the provider network policy. Run ss -tlnp | grep 25 locally, then try nc -zv YOUR_IP 25 from another machine. If the local listener is up but external connection fails, contact your provider about port 25 blocking.

FAQ

How much RAM does an SMTP VPS need?

2 GB is the practical minimum. Postfix, OpenDKIM, and basic monitoring run comfortably in that budget, and you can send thousands of messages per day. Go to 4 GB only if you add a web interface or a queue-heavy application like PowerMTA with multiple concurrent campaigns.

What is the difference between a clean IP and a dedicated IP for email?

A dedicated IP is simply an address used only by you. A clean IP is a dedicated IP with no history of spam, blacklisting, or abuse. Every serious email sender needs both. The dedicated part gives you control, the clean part gives you a starting reputation of zero instead of a negative one.

Is rDNS really required for sending email?

Yes, in practice. Gmail, Outlook, and most other providers reject or spam-folder mail from IPs without a valid PTR record. The record must point to a hostname that matches your HELO and your sending domain. Skipping this one record invalidates all your other email authentication work.

How long does it take to build a good sender reputation?

Realistically two to four weeks of consistent, low-bounce sending. There is no shortcut. Start slow, keep your content clean, monitor your blacklist status weekly, and your reputation compounds. One complaint spike or spam trap hit resets weeks of work.

Can I use this setup for transactional email like password resets?

Yes, and it works well. Transactional mail has a natural advantage because recipients expect it, which means fewer spam complaints. Keep the same DNS and authentication setup, and add a dedicated sending address to keep transactional volume separate from marketing volume.

Related articles

越南SMTP VPS配置要点：干净IP与DNS记录

在越南搭建邮件服务器，最核心的是选择带独立IPv4的VPS，并确认该IP没有黑名单历史。配置Postfix时只允许本机转发，避免变成开放中继。rDNS、SPF、DKIM、DMARC四个记录缺一不可，任何一个是错的都会被Gmail拒收或丢进垃圾箱。新IP必须从小量发送开始，逐步提升信誉，不要一开始就发大量邮件。

Note: This guide is for general reference. Every system and infrastructure has its own specifics, so test each step in a safe environment and consult a qualified engineer before applying it in production.