Self-Hosting a Newsletter Mail Server With Proper DKIM and SPF

For Australian marketers who want full control over deliverability, spinning up a dedicated mail server on your own VPS or dedicated box removes dependency on third-party platforms. You decide the sending IP, the rotation schedule, the header policy, and how each campaign is signed. The trick is getting authentication right so inbox providers at Optus, Telstra, iiNet and the big webmail hosts actually trust the messages leaving your queue.

This guide walks through the practical steps of building a small-scale newsletter pipeline on a Linux host, including DNS records, OpenDKIM signing, Postfix configuration, and the testing workflow most operators in Sydney, Melbourne and Brisbane tend to follow.

Picking a Host and a Clean IP Range

Most aussie operators rent an uncontaminated IPv4 from providers like Vultr, OVH, Hetzner or Aussie outfits like ServersAustralia and Micron21. Avoid residential ranges and anything listed on Spamhaus, SORBS or the Australian Communications and Media Authority's (ACMA) monitored ranges. Before you commit, run the IP through MultiRBL, MXToolbox's blacklist check, and SenderScore. A score below 80 will get you throttled by Microsoft and Google regardless of how clean your content reads.

Set reverse DNS (PTR) to a hostname that resolves forward to the IP. Something like mail.yourbrand.au reads well. Use distinct subdomains for marketing versus transactional mail to keep reputation streams separated.

DNS Records: SPF, DKIM and DMARC Done Properly

SPF should be a tight TXT record on your sending domain. A common shape looks like:

v=spf1 ip4:203.0.113.42 include:_spf.yourbrand.au -all

The hard fail (-all) tells receivers to reject anything that doesn't match. Soft fail (~all) is too forgiving and gets exploited.

For DKIM, generate a keypair with opendkim-genkey -s selector1 -d yourbrand.au. The public key goes in DNS as a TXT record, and the private key lives at /etc/opendkim/private.key with opendkim ownership and chmod 600. Rotate selectors periodically, especially if you operate multiple senders.

A DMARC record starting with v=DMARC1; p=quarantine; rua=mailto:dmarc@yourbrand.au; adkim=s; aspf=s is a sensible default. Once you have consistent alignment, move to p=reject.

Postfix and OpenDKIM Pipeline

Install Postfix and OpenDKIM on Ubuntu or Debian. In /etc/postfix/main.cf, set smtpd_banner, myhostname, mydestination, and tighten SASL with submission on port 587. Pipe outbound mail through the OpenDKIM milter using:

smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock
non_smtpd_milters = $smtpd_milters
milter_default_action = accept

Make sure your inet_interfaces is bound correctly and that outbound traffic on port 25 is unblocked by your provider. Some Australian ISPs (and many cloud providers) throttle or block port 25 by default, so open a ticket early.

Warm-Up Strategy That Actually Works

Cold IP warm-up is non-negotiable. Begin with 50 messages per hour, gradually increasing over 3-4 weeks. Segment your list by engagement: most active Aussie subscribers first (Gmail and Outlook addresses in metro postcodes tend to open more), then mid-tier, then cold. Track bounces, spam complaints and unknown-user rates through a feedback loop with Google Postmaster Tools and Microsoft's SNDS.

Throttle per-IP to stay under thresholds. Most Aussie list managers running solo servers cap daily sends around 50k messages per IP during the warm-up window.

Testing Before You Send for Real

Before pushing live campaigns, validate everything with the standard checks:

Check	Tool / Command	Pass Criteria
SPF alignment	dig TXT yourbrand.au includes sending IP	Record published, policy is -all
DKIM signature	opendkim-testkey -d yourbrand.au -s selector1 -p 25	Returns key OK
DMARC alignment	MXToolbox DMARC check	p=quarantine or stricter
Blacklist status	MultiRBL, Spamhaus DBLSending	No listings
FCrDNS	dig -x <ip> matches forward	Matches sending hostname
Spam score	Mail-Tester.com	Score 9/10 or higher

Aspect	Self-Hosted Server	Commercial ESP
Setup cost	Low (VPS pricing)	Monthly subscription
Control	Full	Limited
Warm-up burden	High	Handled for you
Deliverability ceiling	95–98% possible	99%+ typical
Legal compliance work	Manual (Spam Act 2003)	Provided

Hardening, Rotation and Ongoing Hygiene

Once baseline sends are flowing, add IP rotation across 4-8 addresses if volume warrants, keep PTR and HELO matching, and run a list-cleaning pass every fortnight. Australian regulations under the Spam Act 2003 require consent, an unsubscribe path and accurate sender identification; sending from infrastructure with mismatched headers is a fast track to an ACMA investigation.

Monitor logwatch or pflogsumm daily. Sudden spikes in status=deferred or status=bounced usually mean a reputation event is starting, and acting within a few hours keeps your IP off blocklists.

Practical Recommendations

• Register .au or .com.au for the sending domain to look local to Aussie receivers.
• Keep transactional and marketing streams on separate subdomains and IPs.
• Run list-cleaning tools such as ZeroBounce or your own verifier script before each send.
• Document every config change; DKIM keys get lost, and you don't want to debug signing at 2am AEST.
• Review your DMARC aggregate reports weekly and act on failures promptly.
• Test with Mail-Tester, GlockApps, and Inboxalry before any major campaign.
• Always honour unsubscribes within five business days to stay on the right side of the Spam Act.

A clean, authenticated setup on your own hardware gives flexibility you simply cannot get from a shared platform, but it demands discipline. Treat reputation like capital: spend it slowly, reinvest the returns, and your Aussie campaigns will land where they should — in the primary tab, not the junk folder.