I’m using HestiaCP and I’m having a deliverability issue: emails sent from my server (contact forms + regular mailbox) are landing in spam, especially in Gmail/Outlook.
Current setup
HestiaCP version: v1.9.4
Server OS: Ubuntu 24.04
Mail service: Exim + Dovecot (default Hestia setup)
What I already checked / configured
SPF: configured
DKIM: enabled in Hestia
DMARC: configured
rDNS / PTR record: configured
SSL certificate for mail: yes
What’s the recommended configuration checklist in HestiaCP to improve deliverability?
Are there common Hestia-specific settings (Exim/DKIM/HELO/hostname) that usually cause spam issues?
Any tools/logs you recommend to diagnose this properly (Exim logs paths, mail-tester, etc.)?
As you didn’t provide the domain name, we can’t test the DNS records but you should check this:
1.- Use mail-tester.com and send a mail from your server to the email provided in that page (AFAIK there is a limit of 5 tests per day). It provides a lot of useful info.
Using an SMTP Relay means that the relay will have access to the outgoing emails. If privacy and confidentiality is a matter, you will need to pay special attention here.
One more thing to consider is the domain’s age. If it is a newly registered domain, you will need patience and of course good email hygiene. For starters:
stick to one-to-one emails
avoid the use of BCC
ask partners, friends, etc to unmark/white each and every email that went to spam
ask partners, friends, to whitelist your email address and your domain name
set low limits on the email server (few emails per hour), so that even if someone tries to send mass-mails the system will stop them from ruining your reputation
steer clear of VPS/Cloud providers with “dirty” IP ranges. You can use services like https://www.abuseipdb.com/ so check IP subnet reputation based on abuse reports
monitor, monitor, monitor how and how much your email servers is used
Actually, check your HELO/EHLO hostname in Exim because Hestia sometimes defaults to the system hostname instead of the mail domain. If that doesn’t match your rDNS, Gmail will nukes your deliverability instantly even with perfect SPF/DKIM. You might also want to run a quick test on https://unspam.email/ just to see if your IP is sitting on a specific blocklist you missed… It’s usually more thorough than manual checks.
Basicly this, I personaly do not host any mailservices anymore. Even when you got stable and good ip reputation, they will still drop you from time to time without any logic.
Configured SPF, DKIM and DMARC is not the same as aligned. Gmail still bins mail when the 5322 From domain does not match the SPF envelope or the DKIM d= domain, even if each record exists. Pull a copy that landed in spam and read Authentication-Results. You want spf=pass, dkim=pass, and dmarc=pass on the same From domain, not a pass on the hostname and a fail on the mailbox domain.
The Hestia-specific gotcha is HELO. If Exim greets as the system hostname and that name is not the PTR for the sending IP, Gmail treats it as a spam signal before it even looks at the rest. exim -bP smtp_active_hostname (or the received header on a test message) should match the rDNS you set, character for character.
SPF can also look fine in a web form and still fail: the 10-lookup limit counts nested includes, and a record that prints cleanly can return PermError at evaluation. That shows up as spf=permerror, not as a missing record.
Exim’s reject log is /var/log/exim4/mainlog (or /var/log/exim4/rejectlog for 5xx). Match the Gmail 550 5.7.26 line against MAIL FROM and the connecting IP, not against the domain you typed into a checker.