Configure DNS on VPS Correctly – Reduce Email Going to Spam

June 2026 · 7 min read

DNS is the backbone that everything on the internet depends on. Misconfigure it even slightly and your email ends up in spam, your website won't load, or SSL certificates fail to issue. This article covers all the essential DNS records you need to understand.

Essential DNS Records You Need to Know

A Record: Point Domain to Your VPS

Configure this in your registrar's DNS panel or Cloudflare:

example.com     A  1.2.3.4    TTL 3600
www.example.com A  1.2.3.4    TTL 3600

Verify it has propagated:

dig example.com A +short
# Should return your VPS IP

MX Record: Specify Mail Server

If you use Gmail Workspace or an external email provider:

example.com  MX  10  aspmx.l.google.com.
example.com  MX  20  alt1.aspmx.l.google.com.

If you run a mail server on your VPS:

example.com  MX  10  mail.example.com.
mail.example.com  A  1.2.3.4

SPF Record: Prevent Email Spoofing

SPF tells receiving mail servers which IPs are authorized to send email on behalf of your domain:

example.com  TXT  "v=spf1 ip4:1.2.3.4 ~all"

~all means softfail (email from other IPs may be treated as spam)
-all means hardfail (reject immediately, stricter)

DKIM: Sign Email with Cryptographic Signature

DKIM adds a digital signature to every outgoing email. Recipients can verify that the email hasn't been modified in transit.

The key comes from your mail server software (e.g., Postfix + OpenDKIM):

mail._domainkey.example.com  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqG..."

DMARC: Policy for Email Failing SPF/DKIM

_dmarc.example.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

p=none — Only report, take no action (good for starting out)
p=quarantine — Send to spam folder
p=reject — Reject immediately (strictest policy)

PTR Record: Reverse DNS Critical for Mail Servers

If you run a mail server, a PTR record helps prevent your email from being rejected due to missing reverse DNS.

You must configure this through your VPS provider's control panel (not the regular DNS panel). Set it to point your VPS's IP back to mail.example.com

Checklist When Email Falls Into Spam

1. Verify SPF record covers your server's IP
2. Check DKIM signature is correct and DNS record matches your config
3. Verify PTR record has reverse DNS pointing back correctly
4. Check if your IP is on any blacklist using MXToolbox
5. Review DMARC reports sent to your rua email address

Using dig Commands to Check DNS Records

# Check A record
dig example.com A +short

# Check MX record
dig example.com MX +short

# Check SPF (TXT record)
dig example.com TXT +short

# Check DMARC
dig _dmarc.example.com TXT +short

# Check DKIM (replace selector with actual name, e.g., mail or google)
dig mail._domainkey.example.com TXT +short

# Check PTR (Reverse DNS)
dig -x 1.2.3.4 +short   # Replace with your actual VPS IP

Appropriate TTL Values

Common Issues & Troubleshooting

Website loads but email doesn't arrive and falls into spam

# Check all records
dig example.com TXT +short     # SPF
dig _dmarc.example.com TXT +short  # DMARC

# Send a test email and check the header
# In Gmail: open email → ⋮ → "Show original"
# Look for Authentication-Results to see if SPF/DKIM passed or failed

DNS propagates slowly – still seeing old IP

DNS propagation respects the TTL of the original record. If TTL is 3600, you need to wait 1 hour. Check propagation in different regions:

# Query nameservers directly (bypassing cache)
dig example.com A @8.8.8.8 +short    # Google DNS
dig example.com A @1.1.1.1 +short    # Cloudflare DNS
dig example.com A @208.67.222.222 +short  # OpenDNS

SPF record exceeds 255 characters

DNS TXT records have a 255-byte limit per string. Work around this by using include: instead of listing all IPs directly:

# Instead of: v=spf1 ip4:1.2.3.4 ip4:5.6.7.8 ip4:... ~all
# Use: create separate TXT records then include
# spf1.example.com TXT "v=spf1 ip4:1.2.3.4 ip4:5.6.7.8 ~all"
# example.com     TXT "v=spf1 include:spf1.example.com ~all"

DKIM selector doesn't match between config and DNS

# Check which selector your mail server uses (in Postfix + OpenDKIM)
cat /etc/opendkim/KeyTable
# You'll see something like: mail._domainkey.example.com  example.com:mail:/etc/dkim/...

# Verify DNS record has the matching selector name
dig mail._domainkey.example.com TXT +short

Cannot set PTR Record in regular DNS panel

PTR records must be configured through your VPS provider directly, not through the registrar, because PTR control belongs to the IP block owner. Check your VPS provider's control panel for a "Reverse DNS" or "PTR record" field and enter your hostname there.

Frequently Asked Questions

Do I need SPF, DKIM, and DMARC all together?

You should have all three for best email deliverability. SPF prevents spoofing at the envelope level, DKIM adds a cryptographic signature, and DMARC ties them together and tells mail servers what to do if either fails. Google and Yahoo now require all three for bulk senders under their 2024 Bulk Sender Requirements.

Does Cloudflare Proxy (Orange Cloud) affect DNS records?

It only affects A/AAAA/CNAME records that are proxied. MX, TXT (SPF/DKIM/DMARC), and SRV records are never proxied. Be aware that if you enable proxy, your real VPS IP is hidden. Certbot may need to use DNS challenge instead of HTTP challenge.

How do I check if my IP is on a blacklist?

Use MXToolbox (mxtoolbox.com/blacklists) or MultiRBL to check against 100+ blacklist databases at once. If your IP is listed, contact that blacklist's provider for delisting and fix the underlying issue that got you listed in the first place.

What TTL should I use?

Normally 3600 seconds (1 hour) is sufficient. If you plan to migrate servers soon, lower the TTL to 300 in advance (24–48 hours before migration) so changes propagate faster when you do switch IPs.

Summary

Correctly configured DNS is essential for both web and email. SPF + DKIM + DMARC together significantly reduce email landing in spam and also protect against others spoofing emails from your domain.