Sending email from a server nobody has heard of

Moving a site offshore usually goes well until the first password reset email never arrives. The instinct is to blame the jurisdiction, and it is almost always wrong. Receiving mail servers do not hold opinions about Moldova. They hold records, and a new address has none.

What actually gets your mail refused

Deliverability is a reputation system wearing the costume of a technical standard. A receiver decides what to do with a message by asking how much mail this address has sent before, how much of it drew complaints, and whether the sending domain vouches for the machine in public. A new address answers none, none and no. That is not a penalty but an absence of evidence, and the default for that is the spam folder.

The country enters only through the neighbours. Address space used for spam gets listed, and listings often apply to whole ranges rather than single addresses. That is the selfish argument for a real abuse policy, and why the categories on the acceptable use policy go quickly: a clean range is why an unrelated mail server delivers at all.

Why port 25 is closed until you ask

Outbound port 25 is closed by default here and opened on request after a short conversation about what you intend to send. It reads as an obstacle and is the opposite of one. A host that leaves the port open on every anonymous new machine learns what that attracts within a week, and then the whole range is listed and every honest customer stops delivering.

The four records receivers actually check

1. 01Reverse DNSThe address must resolve back to a hostname, and that hostname forward to the same address. A generic name left by the provider is refused by some receivers before the message is read.
2. 02SPFA record on the sending domain naming which addresses may send for it. Keep it short, end it with a hard fail rather than a soft one, and expect it to break whenever mail is forwarded.
3. 03DKIMA signature over the message itself, verified against a key published in DNS. This is the one that survives forwarding, and the one worth getting right first.
4. 04DMARCTells receivers what to do when the other two disagree, and asks them to report back. Start at none, read the reports for a fortnight, then enforce.

None of that is offshore-specific, which is the point. It only feels harder because a new machine in a new range starts from zero instead of inheriting a history somebody else built.

Volume is the part people skip

Reputation is built by sending slowly, to people who asked for the mail. A server that sends nothing for a month and then emits four thousand messages in an evening looks exactly like what the filters exist to stop. Begin with traffic you cannot avoid — password resets, receipts, notifications — and let volume rise over weeks rather than hours.

• Keep transactional mail and bulk campaigns on separate domains, or at minimum separate subdomains.
• Handle bounces. Sending again to an address that hard-bounced is the loudest signal nobody is minding the list.
• Publish an unsubscribe header on anything bulk and honour it on first request.
• Watch the listings yourself rather than hearing about one from a customer.
• Never buy or import a list. That ends the domain, not merely the address.

The separation worth making

There is a structural reason to keep mail off the machine carrying whatever you moved offshore to protect. Mail forces a public name and a public address to point at each other, permanently, in DNS — the opposite of keeping an origin quiet, which is the whole shape of putting a proxy in front of it. An MX record and a matching reverse lookup announce exactly where the machine sits.

So send from somewhere allowed to be loud. A second small instance, a different domain, a relay — anything that means the address handling your mail is not the address holding your data. The question underneath that choice is the one in choosing a domain that survives a takedown, because a registrar that pulls the domain takes the mail with it.

When not to run a mail server at all

For most projects the honest answer is to hand outbound mail to a relay and stop thinking about it. A relay arrives with reputation already built, and everything above collapses into publishing two DNS records. Running the stack yourself earns its keep in three cases: the mail is itself the sensitive part, a relay would refuse your subject matter, or a provider account somebody can close is precisely the dependency you came here to remove.

What a host can and cannot do

Ours is a narrow contribution, worth stating plainly. We keep the ranges clean by removing what poisons them, we open port 25 for people who explain themselves, and we do not inspect what you send. We cannot make a receiver trust a two-day-old address, and no host anywhere can. That is earned message by message, the same way in every jurisdiction.

Published by NoDMCAVPS, an offshore host that files automated DMCA notices instead of forwarding them. What we still remove is listed in the acceptable use policy.