Self-hosted email in 2026: Postfix, DKIM and DMARC that deliver
Self-hosted email in 2026 that actually hits the inbox: outbound Postfix, DKIM, DMARC and rDNS on a clean IP — without renting Big Tech's reputation.
The inbox survives because of a few records, not a brand name. SPF, DKIM, DMARC and a matching forward/reverse DNS decide whether your self-hosted mail arrives or drowns in spam filters — and all four are under your control on a static, clean IP with rDNS you set yourself.
The four records that matter
- ▹SPF: v=spf1 ip4:<your-ip> -all — who is allowed to send as your domain.
- ▹DKIM: a signed selector record your MTA publishes per domain.
- ▹DMARC: p=quarantine plus a report address to audit false negatives.
- ▹rDNS: a PTR matching your HELO — the check big providers run first.
Outbound-only is the safe shape
Bind Postfix to loopback so nothing on the internet can relay through you, and accept only from local services. The full Postfix + DKIM walkthrough turns a small VPS into a delivery-capable relay you fully own — a meaningful step away from renting mail from a platform that trains models on it.