Managed VPS Mail Gateway: Inbound Antispam Included, MailChannels Relay When You Send

RemarkableCloud Team

Why does email from a VPS end up in spam?

Because mailbox providers judge the sending IP before they read a single header, and a VPS IP address arrives with a past. Gmail, Microsoft, and Yahoo score reputation per IP and per range, and VPS ranges score poorly by default: they are where compromised WordPress sites, throwaway spam servers, and botnet nodes live. Your invoices and password resets share a neighborhood with them, and filters treat the neighborhood, not the house.

Perfect DNS does not exempt you. SPF, DKIM, and DMARC prove that the mail is really yours; they say nothing about whether “you” are worth trusting. A correctly authenticated message from a low-reputation IP is simply well-authenticated spam as far as the filter is concerned. Since Google and Yahoo tightened bulk-sender rules in 2024, authentication became the entry ticket while IP reputation remained the actual game.

What does every RemarkableCloud server include for mail?

Inbound protection, at no extra cost. Incoming mail is filtered for spam and malware with Rspamd before it reaches your mailboxes, so they are protected without you running a filtering stack. It is part of full management, like monitoring and the managed firewall.

Outbound is handled differently, on purpose. SMTP port 25 stays closed by default on every server. That is an anti-abuse measure: a compromised plugin or contact form cannot start spamming from your IP and burn its reputation, or the reputation of the range your neighbors depend on.

What is an outbound mail gateway?

An outbound mail gateway is a relay that takes mail from your server and delivers it from the gateway’s own high-reputation IPs instead of yours. Your VPS hands the message to the relay over an authenticated connection, the relay delivers it, and Gmail sees a sender it already trusts, one whose business depends on staying trusted.

When your server needs to send mail directly, the MailChannels relay is an optional add-on from $8/mo. MailChannels is the largest transactional relay in the hosting industry, and it filters outbound traffic too, which protects the loop in the other direction: if a site on your server is ever compromised and starts spamming, the gateway catches it before it burns any reputation, and we get the signal to clean it up rather than a blacklist entry.

Do I still need SPF, DKIM, and DMARC with a gateway?

Yes, all three, and they take minutes on a managed plan. The gateway fixes the reputation problem; authentication proves domain ownership, and mailbox providers now require both. Since 2024, mail to Gmail and Yahoo without alignment fails increasingly hard regardless of the sending IP.

The division of labor on a RemarkableCloud server: DNS records for SPF, DKIM, and DMARC are set up as part of management, and our guides cover the details if you like to see the machinery, SPF, DKIM and DMARC explained for the concepts and the cPanel Email Deliverability doc for the click-by-click. If you would rather not think about any of it, that is what the ticket queue is for.

When do I need the MailChannels relay?

When your server itself sends mail: WordPress or WooCommerce notifications, contact forms, invoices from a billing app, or a self-hosted mail server like Mailcow. If all of your sending already goes through a dedicated email service, or your server only receives mail, you may not need it at all.

Priced separately elsewhere, a transactional relay for a small business runs $10 to $30 per month. The more common cost is silent: hosts without a gateway leave you sending from the bare VPS IP, and you pay in support hours, warm-up rituals, blacklist removal requests, and quotes that never arrived. We keep the relay optional because not every server sends mail, and we price it plainly so the servers that do can get reputation-backed delivery without a separate contract.

How do I know if my current setup has this problem?

Three checks, ten minutes. First, look up your server’s IP on a multi-blacklist checker; listings on Spamhaus or SpamCop mean the neighborhood already burned you. Second, send a test to a Gmail account and read the headers: Received: shows which IP delivered, and if it is your VPS IP, you are playing reputation roulette. Third, check your DMARC reports, and if you have never seen a DMARC report, that is itself the finding.

If any check fails, you have two paths: build the stack yourself (relay contract, DNS work, monitoring, warm-up) or move to a host that runs it for you. Every managed server includes inbound antispam, authenticated DNS set up for you, and free migration in; add the MailChannels relay and the outbound fix costs a ticket, not a project.

FAQ

Is the mail gateway included on every server?

Inbound antispam is. Rspamd filtering is included on every managed server at every size, along with monitoring, daily snapshots, and the 500% SLA. The MailChannels outbound relay is an optional add-on from $8/mo, for servers that send mail.

Why is port 25 closed by default?

To stop abuse before it starts. With port 25 closed, a compromised site cannot send spam straight from your server’s IP and get it blacklisted. Mail your server sends goes out through the authenticated MailChannels relay instead.

Can I still use an external service like Postmark or SES?

Of course. If your application already sends through a dedicated ESP, keep it; those services are excellent at what they do. The MailChannels relay is for the default path, the mail your server, sites, and forms send out of the box, so it is deliverable from day one.

Does the relay help with mailing lists and newsletters?

It covers normal business sending, and bulk marketing has additional rules of its own: list hygiene, one-click unsubscribe, and the sub-0.3% complaint rates Gmail and Yahoo now enforce. For large campaigns we recommend a purpose-built ESP alongside the relay, and our team will happily tell you where the line is for your volume.