How to set up and run your own mail server (and when hosted email is smarter)

To run your own mail server you need a server with a static IP address and port 25 open, a domain name, mail software such as Postfix and Dovecot, a TLS certificate and the right DNS records: MX, PTR, SPF, DKIM and DMARC. Installing it is the smallest part of the job; most of the work comes afterwards, from updates and spam to making sure Gmail and Outlook keep accepting your mail. If what you really want is reliable email on your own domain, hosted email is usually the smarter choice.

This guide covers how a mail server works and routes mail, what you need, how to build one step by step, why a home mail server is hard, how to test and troubleshoot a mail server, and when hosted email is the better fit.

What does a mail server do?

A mail server has three jobs: it accepts mail for your domain from other mail servers, it stores that mail in the right mailbox and it sends the mail you and your colleagues write. A few programs work together to do this:

• An MTA (mail transfer agent) such as Postfix or Exim. It speaks SMTP to other mail servers: it accepts mail on port 25 and delivers outgoing mail to the recipient's server.
• An IMAP and POP3 server such as Dovecot, which your email app uses to fetch messages. The difference between these protocols is explained in IMAP vs POP3 vs SMTP.
• A spam filter such as Rspamd or SpamAssassin, which scores incoming mail. Rspamd can also sign outgoing mail with DKIM.
• Webmail such as Roundcube, if you also want to read your mail in a browser.

How does a mail server know where to send email?

When you send a message to someone@example.com, your mail server looks up the MX record of example.com in DNS. That record names the server that accepts mail for the domain. Under the mail standard RFC 5321, delivery then works like this:

1. If there are several MX records, the sending server tries the one with the lowest number (the preference or priority) first.
2. If that server does not respond, it tries the next one. Records with the same number are picked at random, which spreads the load.
3. If a domain has no MX record, the sending server falls back to the domain's own A or AAAA record. An MX record that contains only a dot, the null MX from RFC 7505, means the domain does not accept mail at all.
4. If delivery fails temporarily, the sending server tries again later.

For the structure of an MX record and how to set one up, see what is an MX record.

What do you need to run your own mail server?

Check port 25 before you pick a server. Google Cloud, AWS, Microsoft Azure, Hetzner Cloud and DigitalOcean all block outbound port 25 by default. AWS and Hetzner let you request that the block is lifted, and on Azure it depends on your subscription type.

How to set up a mail server, step by step

1. Choose a server and check its IP address. Confirm that outbound port 25 is open or can be opened, and look the IP address up at Spamhaus to see whether it is on a blocklist. An address with a poor reputation makes your start much harder.
2. Give the server a fixed hostname. Pick a name such as mail.yourdomain.com and create an A record for it, plus an AAAA record for IPv6. Ask the owner of the IP address to set a PTR record that points to exactly that name (see below).
3. Install the software. Install the parts separately, for example Postfix, Dovecot and Rspamd on Debian or Ubuntu, or use one of the all-in-one packages in the table below.
4. Get a certificate. Request a certificate for mail.yourdomain.com, for example from Let's Encrypt, and have it renew automatically. Let's Encrypt certificates are currently valid for 90 days; according to Let's Encrypt that drops to 64 days from February 2027 and to 45 days in 2028. Let your ACME client decide when to renew instead of hard-coding a fixed interval.
5. Publish your DNS records. Point your domain's MX record to mail.yourdomain.com and publish an SPF record that includes your server's IP address. Add the public key for DKIM and start with a DMARC record set to p=none, so you get reports before you tighten the policy.
6. Create mailboxes and aliases. How a mail server keeps track of them is explained below.
7. Test everything. Send a message to a Gmail and an Outlook.com address and check in the headers that SPF, DKIM and DMARC show pass. The internet.nl email test checks your domain for DMARC, DKIM, SPF, STARTTLS and DANE, among other things.
8. Set up backups, updates and monitoring. Only then is your mail server ready for real mail. What that maintenance involves is covered further down.

All-in-one mail server packages

If you would rather not install and wire up every part yourself, these packages set up a complete mail server in one go:

How does a mail server keep track of its email addresses?

A mail server needs to know which domains and addresses it accepts, where each mailbox lives and which password belongs to it. In Postfix this lives in lookup tables, as the Postfix documentation describes:

• virtual_mailbox_domains: the domains the server hosts mailboxes for.
• virtual_mailbox_maps: the mailbox location for each email address.
• virtual_alias_maps: aliases and forwarding addresses, such as info@ forwarding to a colleague.

On a small server these tables are text files that you process with the postmap command after every change. With more addresses, Postfix reads them straight from a database such as MySQL or PostgreSQL, or from LDAP. Dovecot checks passwords through its passdb and looks up mailbox details in its userdb, often backed by the same database. The all-in-one packages give you a web-based admin panel for all of this.

At LJPc hosting you skip the tables: you create an address in the customer portal or in Plesk, as described in create an email address in the customer portal.

Can you run a mail server at home?

A mail server on a home computer or NAS sounds appealing, but it runs into a few walls:

• Port 25 is blocked. Many residential ISPs block outbound port 25 to fight spam, including Ziggo and Odido in the Netherlands. Your server then cannot deliver mail to other mail servers.
• Your IP address has no reputation as a mail server. Residential IP addresses can be listed on the Spamhaus Policy Block List, which covers end-user addresses that should not deliver mail directly to mail servers. Many receiving servers use that list.
• Your ISP controls the PTR record. The IP address belongs to your ISP, so only your ISP can point its PTR record at your mail server.
• Power, connection and hardware. If your connection or computer goes down, or your IP address changes, no mail comes in until you fix it.

If you want to learn how a mail server works, run it on a VPS from a provider that allows port 25 and a custom PTR record. If you are building a website or app and want to see the mail it sends, use a local test server such as Mailpit. It catches every message and shows it in your browser; it only relays mail to real recipients if you configure it to.

How to set up a PTR record for your mail server

The PTR record maps your mail server's IP address to a hostname. Gmail requires every sender's hostname to point back to the same IP address. Here is how to set it up:

1. Create an A record for your mail server's hostname, for example mail.yourdomain.com, with your server's IP address, plus an AAAA record for IPv6.
2. Have the owner of the IP address set the PTR record: in your VPS provider's control panel or through your data centre's support. You cannot create it in your own DNS zone.
3. Make your mail server announce itself with the same name. In Postfix that is the myhostname setting.
4. Check both directions: dig +short -x 203.0.113.10 should return mail.yourdomain.com and dig +short mail.yourdomain.com should return 203.0.113.10.

If your server also sends mail over IPv6, that IPv6 address needs a PTR record too. The details are in what is a PTR record.

Can you ping a mail server?

Yes, if the server's firewall allows ping (ICMP). But a ping reply only tells you the server is up, not that mail works, and a server that ignores ping can still accept mail perfectly well. Test the mail port itself instead:

• On Linux and macOS: nc -vz mail.yourdomain.com 25. If the port is open, nc reports that the connection succeeded. Run nc mail.yourdomain.com 25 without -vz to see the server's greeting, a line starting with 220; type QUIT to close it.
• On Windows in PowerShell: Test-NetConnection mail.yourdomain.com -Port 25. If the port is open, you see TcpTestSucceeded : True.
• To check the certificate, run openssl s_client -starttls smtp -connect mail.yourdomain.com:25. A valid certificate shows Verify return code: 0 (ok).

If the test fails from your home connection, try another network: when your ISP blocks port 25, the test fails even against a working server. Your email app uses different ports. At LJPc hosting those are 993 for IMAP and 465 or 587 for SMTP, on the server ljpc.email.

Fixing an incoming mail server that stopped receiving email

Your email app cannot reach the incoming mail server

When your email app says the incoming mail server is not responding, the cause is usually the settings or your password. Work through these steps:

1. Log in to webmail. If that works, the server and your password are fine. At LJPc hosting, webmail is at ljpc.email.
2. Check the server settings. At LJPc hosting the incoming server is ljpc.email, port 993 with SSL/TLS for IMAP or port 995 with SSL/TLS for POP3, with your full email address as the username. All settings are in set up your email on your phone, tablet and computer.
3. If it works on mobile data but not on your own Wi-Fi, your IP address may have been blocked after too many failed logins. What is Fail2ban explains how to recognise and lift such a block.

More causes and fixes are in how to fix email problems.

Your own mail server receives nothing

1. Check the MX record with dig +short MX yourdomain.com. Does it still point to your mail server?
2. Check the hostname with dig +short mail.yourdomain.com. Is the IP address still right, for example after moving to a new server?
3. Test port 25 from outside, as shown above. If the connection does not open, look at the firewall on the server and at your provider.
4. Check that the mail software is running, for example with systemctl status postfix dovecot, and read the mail log in /var/log/mail.log or the systemd journal.
5. Check free disk space with df -h. When the disk is full, Postfix temporarily refuses new mail.
6. Check the certificate. If it has expired, servers that require valid encryption, for example with DANE, will refuse to deliver.
7. Look at the queue with postqueue -p to see which messages are stuck.

The mail is usually not lost. Under RFC 5321 a sending server generally keeps retrying for at least four to five days after a temporary failure, so if you fix the problem within that window, the mail still arrives.

Running a mail server: what maintenance does it take?

A mail server is never finished. This is the work that stays:

• Updates and security. Install security updates promptly, make sure your server is not an open relay that forwards anyone's mail, and block attackers who try to guess passwords, for example with Fail2ban.
• Deliverability. Gmail requires every sender to use SPF or DKIM, valid forward and reverse DNS, TLS and a spam rate below 0.3%. Senders of around 5,000 messages a day or more to Gmail addresses need SPF, DKIM and DMARC, plus one-click unsubscribe for marketing mail. Since November 2025 Gmail enforces this more strictly, including rejecting mail. Microsoft sets similar rules for senders of more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses, and rejects mail that falls short with error code 550 5.7.515.
• Reputation. One hacked account sending spam can get your IP address blocklisted. Read your DMARC reports and check regularly whether your IP address appears on a blocklist.
• Spam filtering. Your spam filter needs care: updating rules, releasing mail that was wrongly flagged and spotting new spam waves.
• Backups and restores. Back up the mailboxes, the configuration and your DKIM keys, and test that a restore works.
• Certificates and DNS. Keep an eye on automatic certificate renewal. If you use DANE, update your TLSA records as well; see what is DANE.
• Monitoring. Get alerts when the server or a port is unreachable, the disk fills up or the queue grows. An outage at 3 a.m. is your outage too.

Using Gmail as your mail server

If you are looking for Gmail's mail server settings, you probably want to use your Gmail address in another email app. Gmail's outgoing mail server is smtp.gmail.com on port 465 (SSL/TLS) or 587 (STARTTLS), and the incoming server is imap.gmail.com on port 993 (SSL/TLS). You sign in with Sign in with Google. For email on your own domain you need a Google Workspace account at Google, or hosting with email such as LJPc hosting. Both sets of settings side by side, and how to use your own address in the Gmail app, are in using your own email address in Gmail.

Self-hosted or hosted email: which suits you?

A self-hosted mail server suits you if you want to learn the craft, if you have a requirement a hosting provider cannot meet, or if you have an administrator with time set aside for it. If you mainly want your mail to arrive and someone else to look after the servers, hosted email is the smarter choice. Take a look at our web hosting packages.

What LJPc hosting takes care of

• Unlimited mailboxes in every web hosting package. You create them in the customer portal or in Plesk.
• One server for all your devices: ljpc.email for IMAP, POP3 and SMTP, with webmail at the same address. Your mail is set up on your phone and computer within minutes.
• Spam filtering at the front door: incoming mail arrives through our spam gateways mx1.ljpc.email and mx2.ljpc.email. If one fails, a standby gateway takes over automatically. Want to manage your spam yourself? Then there is the premium spam filter.
• DNS records set up right: with hosting and DNS at LJPc, your MX, SPF, DKIM and DMARC records are ready to go. If your domain is registered with us and uses our name servers, we also take care of DNSSEC and DANE for your incoming mail.
• Security: Fail2ban blocks IP addresses that try a wrong password too often.
• Help when you switch: moving from your own mail server or another provider? We are happy to help with the migration. The step-by-step plan is in how to migrate email to a new server.

Not sure whether your own mail server or email with us fits you better? Call +31 85 130 6429, email support@ljpc.nl or create a support ticket. We are happy to think it through with you.