Email deliverability & sending — Docs — the lean cPanel alternative

Nimbopanel runs a full mail stack (Postfix, Dovecot, OpenDKIM) for your customers. Receiving email works as soon as your DNS is set. Sending to the outside world needs one extra step on almost every budget VPS — this is the part people most often get stuck on, so it's worth understanding.

Receiving works out of the box

Once you've added the mail DNS records (below), your server accepts mail for your hosted domains, stores it, and serves it over secure IMAP (port 993) and webmail. Nothing else is needed to receive.

Publish these records at your DNS host (Nimbopanel generates them automatically in each account's zone — copy the values into Cloudflare / your registrar):

Type	Name	Value
MX	`@`	`mail.yourdomain.com` (priority 10)
TXT	`@`	`v=spf1 mx a:mail.yourdomain.com ~all` (SPF)
TXT	`_dmarc`	`v=DMARC1; p=none; rua=mailto:postmaster@yourdomain.com`
TXT	`<selector>._domainkey`	the DKIM public key shown in the panel's Email tool

Why sending needs a relay

Almost every low-cost VPS provider blocks outbound port 25 (the port mail servers use to talk to each other). It's an anti-spam measure and it's on the provider's network, not your server — you cannot turn it off yourself, even as root. So mail your customers send would just time out.

There are two ways around it:

Ask your provider to unblock port 25 — some will, after your account ages or you open a ticket explaining you run a mail server. Best if they allow it, and pair it with a custom rDNS/PTR (see Provider notes). But many providers won't lift it quickly.
Use an SMTP relay — mail goes out through a reputable provider on port 587 (which is not blocked), from IPs with good reputation. This is the recommended, self-service path — it works today without waiting on your provider, and usually delivers better than sending directly from a cheap VPS IP anyway.

Set up a relay (recommended)

1. Pick a relay provider and create an account:

Provider	Free tier	Notes
Brevo	300 emails/day, no card	Easiest to start
SendGrid	100/day	Simple SMTP
Amazon SES	pay-as-you-go (cheapest at scale)	Needs domain verification + leaving the sandbox

Volume note: transactional relays are meant for your mail. If you'll relay large volumes of many customers' mail, use a provider that permits it (e.g. SES set up correctly) or get port 25 unblocked.

2. Get the SMTP credentials from the provider's dashboard — the SMTP tab (not the "API keys" tab):

SMTP server (e.g. smtp-relay.brevo.com)
Port 587
Login (this is a specific SMTP login the provider shows — often not your account email)
SMTP key / password

If your provider has an "authorized IPs" security setting, add your server's IP to it, or SMTP authentication will be refused.

3. Enter the credentials in Nimbopanel. Relay credentials live in your server's root-only configuration — never in the panel database or the web UI (the same discipline as all secrets). Set the mail relay there and Nimbopanel configures Postfix to send through it, authenticated and over TLS. A quick test send confirms it: a successful hand-off shows status=sent in the mail log.

Make mail land in the inbox (not spam)

Getting mail out is step one; getting it into the inbox needs authentication that the recipient (Gmail, Outlook) can verify:

SPF — when you send through a relay, mail leaves from the relay's IPs, so add the relay to your SPF record, e.g.: v=spf1 mx a:mail.yourdomain.com include:spf.brevo.com ~all
DKIM — verify your domain in the relay's dashboard and add the DKIM records they give you to your DNS. (For direct sending, Nimbopanel signs with its own DKIM key automatically.)
DMARC — Nimbopanel publishes a safe p=none DMARC record per domain; you can tighten it later.

With SPF, DKIM, and DMARC all passing, your customers' mail is trusted and lands in the inbox.