A question about VPS hosting of multiple email domains and occasional rejections

For a year or more now with Hestia I’ve had very few email issues, but occasionally I get emails returned as undeliverable with very little info to go on from the rejecting server. Previously I had assumed that this was just a thing you deal with when self hosting, companies blocking domains that are not popular, but I’m also kind of wondering if maybe I have something subtly misconfigured.

I guess the most obvious question is for the mx dns entry, as it is the only thing I ever see in the returned emails. Should my hosted domains each use their own mail.domainname-1.com, etc., or should each mx record point to the main server? I have all of this setup and it’s been working, but it seems like something is tripping up certain servers. Maybe it is that they can see that the IP resolves to main mail server domain rather than the virtual host mx? But I can only have one reverse dns record with my host as far as I know, so I’m not sure what else to do short of having each hosted domain use the main mail server rather than their own virtual ones. Less than idea but if this is the problem I would change it.

Is there a way to test this without reconfiguring actual mail servers? I’ve tried the usual online mail tools and things seem fine.

Here’s a dns record on one of my hosted domains (info obfuscated, not sure I did that now since it’s public anyways ha):

@

NS
14400
ns1.maindomain.com.
@

NS
14400
ns2.maindomain.com.
@

A
14400
1.2.3.4
www

CNAME
14400
vhost1.com.
ftp

CNAME
14400
vhost1.com.
mail

A
14400
1.2.3.4
@

MX
0
14400
mail.vhost1.com.
@

TXT
14400
"v=spf1 a mx ip4:1.2.3.4 -all"
_dmarc

TXT
14400
"v=DMARC1; p=quarantine; pct=100"
_domainkey

TXT
14400
"t=y; o=~;"
mail._domain...

TXT
14400
"v=DKIM1; k=rsa; p=<key>"
@

CAA
14400
0 issue "letsencrypt.org"
webmail

A
14400
1.2.3.4

Any help or advice is greatly appreciated!

Did you use @ like the main domain? Because that record should be for mail._domainkey.example.net

It’s always better to share the actual domain, especially if you’re asking to debug the DNS configuration.

1 Like