Email Deliverability from Hong Kong VPS: SPF, DKIM, DMARC Setup (2026)

Sending email from a Hong Kong VPS without proper configuration means your transactional emails — order confirmations, password resets, notifications — land in spam folders or get rejected entirely. Configuring SPF, DKIM, DMARC, and PTR records correctly turns your VPS into a reputable email sender that reaches inboxes at Gmail, Outlook, QQ Mail, and NetEase — the dominant providers for your Asia-Pacific audience.

The Four Email Authentication Records

Step 1: Set Reverse DNS (PTR Record)

Every major email provider checks that your sending IP resolves to a hostname matching your domain. Without PTR, your email scores poorly before any content analysis.

In the Server.HK control panel → VPS → Reverse DNS: set your VPS IP’s PTR record to mail.yourdomain.com (or your chosen mail hostname).

<code"># Verify PTR record is set correctly (after ~5 minutes propagation)
dig -x YOUR_VPS_IP +short
# Should return: mail.yourdomain.com.

# Also verify forward lookup matches
dig mail.yourdomain.com A +short
# Should return: YOUR_VPS_IP

Step 2: Install and Configure Postfix

<code">apt update && apt install -y postfix mailutils

# During setup: choose "Internet Site", domain = yourdomain.com

# Configure Postfix main settings
cat >> /etc/postfix/main.cf << 'EOF'

# Identity
myhostname = mail.yourdomain.com
mydomain = yourdomain.com
myorigin = $mydomain

# Restrict relay
mynetworks = 127.0.0.0/8

# TLS for outbound
smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

# TLS for inbound (if accepting mail)
smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.yourdomain.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.yourdomain.com/privkey.pem

# Rate limiting (prevent abuse)
smtp_destination_concurrency_limit = 5
default_destination_rate_delay = 1s
EOF

systemctl restart postfix

# Send a test email
echo "Test from HK VPS" | mail -s "Test" you@gmail.com

Step 3: SPF Record

Add a TXT record to your DNS authorising your VPS IP to send email for your domain:

<code"># DNS TXT record for yourdomain.com:
# Name: @  (or yourdomain.com)
# Type: TXT
# Value: v=spf1 ip4:YOUR_VPS_IP ~all

# Example: if VPS IP is 103.45.67.89
v=spf1 ip4:103.45.67.89 include:sendgrid.net ~all
# The include: adds any transactional email service you also use

# Verify SPF (after DNS propagation):
dig yourdomain.com TXT +short | grep spf

SPF modifiers explained: ~all (softfail — deliver but mark suspicious) is safer during testing; change to -all (hardfail — reject) once you have confirmed all legitimate sending sources are listed.

Step 4: DKIM with OpenDKIM

<code">apt install -y opendkim opendkim-tools

# Generate DKIM keypair
mkdir -p /etc/opendkim/keys/yourdomain.com
opendkim-genkey -t -s mail -d yourdomain.com \
  -D /etc/opendkim/keys/yourdomain.com/
chown -R opendkim:opendkim /etc/opendkim

# View the public key (add this to DNS)
cat /etc/opendkim/keys/yourdomain.com/mail.txt

The output looks like:

<code">mail._domainkey IN TXT ( "v=DKIM1; k=rsa; "
  "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC..." )

Add a DNS TXT record: Name = mail._domainkey, Value = the p=... string (combine all quoted parts into one string).

<code"># Configure OpenDKIM
cat > /etc/opendkim.conf << 'EOF' Domain yourdomain.com KeyFile /etc/opendkim/keys/yourdomain.com/mail.private Selector mail Socket inet:12301@localhost RequireSafeKeys false EOF # Connect Postfix to OpenDKIM cat >> /etc/postfix/main.cf << 'EOF'
milter_protocol = 6
milter_default_action = accept
smtpd_milters = inet:localhost:12301
non_smtpd_milters = inet:localhost:12301
EOF

systemctl enable --now opendkim
systemctl restart postfix

# Verify DKIM record in DNS:
dig mail._domainkey.yourdomain.com TXT +short

Step 5: DMARC Record

<code"># DNS TXT record:
# Name: _dmarc.yourdomain.com
# Type: TXT
# Value:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; ruf=mailto:dmarc@yourdomain.com; fo=1

# p=none: monitor mode (don't reject anything yet)
# rua: aggregate reports sent here daily
# ruf: forensic reports for individual failures

# After confirming all legitimate email passes:
# p=quarantine → suspicious mail goes to spam
# p=reject → suspicious mail is blocked entirely

# Verify:
dig _dmarc.yourdomain.com TXT +short

Step 6: Test Deliverability

<code"># Send test email and check headers
echo "Deliverability test $(date)" | mail -s "DKIM/SPF Test" test@gmail.com

# In Gmail: open email → More (⋮) → Show original
# Look for:
# SPF: PASS
# DKIM: PASS
# DMARC: PASS

# Online testing tools:
# 1. https://mail-tester.com — score out of 10, detailed analysis
# 2. https://mxtoolbox.com/SuperTool.aspx — DNS record verification
# 3. https://dmarcian.com/dmarc-inspector/ — DMARC policy check

Check Chinese Email Providers

<code"># QQ Mail (qq.com) and NetEase (163.com) are the dominant Chinese email providers
# Test by sending to test accounts at both:
echo "Test" | mail -s "Test CN" testaccount@qq.com
echo "Test" | mail -s "Test CN" testaccount@163.com

# Check spam rates with:
# https://postmaster.mail.qq.com — QQ Mail Postmaster (requires registration)
# https://postmaster.163.com — NetEase Postmaster

Step 7: Postfix Rate Limiting and Reputation Protection

<code"># Prevent your VPS IP from being blacklisted due to abuse
cat >> /etc/postfix/main.cf << 'EOF'
# Limit outbound connections (prevent spam flooding)
smtp_destination_concurrency_limit = 5
smtp_destination_rate_delay = 1s
smtp_extra_recipient_limit = 10

# Reject mail from unknown senders
smtpd_recipient_restrictions =
    permit_mynetworks,
    reject_unauth_destination

# Message size limit (10MB)
message_size_limit = 10240000
EOF

systemctl reload postfix

Monitor IP Reputation

<code"># Check if your VPS IP is on any blacklists
# Run from local machine:
mxtoolbox.com/blacklists.aspx  # Enter YOUR_VPS_IP

# Or via command line:
for bl in zen.spamhaus.org bl.spamcop.net b.barracudacentral.org; do
  result=$(dig +short YOUR_VPS_IP_REVERSED.$bl)
  [ -n "$result" ] && echo "LISTED: $bl ($result)" || echo "Clean: $bl"
done
# Replace YOUR_VPS_IP_REVERSED with your IP octets reversed
# e.g., 103.45.67.89 → 89.67.45.103

Step 8: Use a Transactional Email Service for High Volume

For applications sending more than 1,000 emails/day, use a dedicated transactional email service — your VPS sends via their SMTP relay, benefiting from their established IP reputation:

<code"># Configure Postfix to relay via SendGrid
cat >> /etc/postfix/main.cf << 'EOF' relayhost = [smtp.sendgrid.net]:587 smtp_sasl_auth_enable = yes smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd smtp_sasl_security_options = noanonymous smtp_tls_security_level = encrypt EOF echo "[smtp.sendgrid.net]:587 apikey:YOUR_SENDGRID_API_KEY" \ > /etc/postfix/sasl_passwd
postmap /etc/postfix/sasl_passwd
chmod 600 /etc/postfix/sasl_passwd
systemctl restart postfix

Conclusion

Email deliverability from a Hong Kong VPS requires four correctly configured records — PTR, SPF, DKIM, and DMARC — plus responsible sending practices. With these in place, transactional emails from your VPS reach Gmail, Outlook, QQ Mail, and NetEase inboxes reliably. For high-volume sending, relay through a transactional email service while keeping your VPS PTR and SPF properly configured as the sending identity.

Start sending reliably: Browse Server.HK Hong Kong VPS plans — all plans support custom PTR (reverse DNS) configuration through the control panel.