Use case · Mail server and port 25
What works with outgoing port 25 closed, how to send through a relay, and the SPF, DKIM and DMARC records every sending domain needs.
Quick answer
Can I host a mail server on an offshore dedicated server?
Yes, you can host a mail server on an offshore dedicated server at Ironatoll, with one limit. Outgoing port 25 is closed, so the server cannot deliver mail straight to other servers. It receives mail, stores mailboxes and sends through a relay (smarthost) on port 587 or 465. Servers cost from $63.68 per 30 days, no KYC, paid in crypto. Bulk email is banned.
| Outgoing port 25 | Port 25 (SMTP) is blocked for outgoing traffic on every server as an anti-spam measure, and the block is permanent. Outgoing connections to mail providers on ports 465 and 587 work normally |
|---|---|
| Receiving mail (MX) | Works: the block covers outgoing connections, so other servers can deliver to yours |
| Sending mail | Through a relay (smarthost) you log in to, on port 587 (STARTTLS) or 465 (implicit TLS) |
| Direct delivery to other servers | Not possible: it needs outgoing port 25 |
| Mailboxes and IMAP | Work: your users read their mail from your server |
| Reverse DNS | Not among Ironatoll's published promises; with a relay, receivers check the relay's address |
| Backups | There are no automatic backups, so every file you need to keep should also live somewhere you control |
| Bulk email | Banned on every plan, through any port or relay |
To keep spam from leaving the network. Port 25 (SMTP) is blocked for outgoing traffic on every server as an anti-spam measure, and the block is permanent. Outgoing connections to mail providers on ports 465 and 587 work normally.
Port 25 is where mail servers hand mail to each other; ports 587 and 465 are where senders log in to their provider. RFC 6409 keeps server-to-server relay on port 25 and reserves port 587 for submission, with a login required by default. RFC 8314 gives port 465 to submission with implicit TLS: encryption starts as soon as the connection opens.
Spam from rented servers leaves on port 25. Closing it protects the reputation of every address in the network, yours included. The rule is the same for every server and every plan.
Yes. The block applies to connections your server opens, not to connections other servers open to it. Point your domain's MX record at your server, and other mail servers deliver to it on port 25.
A typical stack on Debian or Ubuntu:
Mail is data you cannot rebuild. There are no automatic backups, so every file you need to keep should also live somewhere you control.
Set your mail server to hand every outgoing message to a relay that you log in to. The relay then delivers on its own port 25. Ironatoll keeps ports 465 and 587 open towards mail providers for this.
Use your mail provider's SMTP submission service, or a transactional relay that accepts your domain. In Postfix, the official SASL guide sets it up in a few lines:
# /etc/postfix/main.cf
relayhost = [smtp.relay.example]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
smtp_sasl_tls_security_options = noanonymous
smtp_tls_security_level = encrypt
# Port 465 instead: relayhost = [smtp.relay.example]:465
# plus smtp_tls_wrappermode = yes (Postfix 3.0 and later)
# /etc/postfix/sasl_passwd (owned by root, mode 600)
[smtp.relay.example]:587 username:password
# Then: postmap /etc/postfix/sasl_passwd && systemctl reload postfix
# Some systems use hash: or cdb: instead of lmdb:The square brackets stop Postfix from looking up MX records for the relay's name. With smtp_tls_security_level = encrypt, your password never crosses an unencrypted link.
Yes: receivers use all three to decide whether mail really comes from your domain. Each one is a DNS record.
v=spf1. A check may use at most 10 DNS lookups. With a relay, list the relay's hosts: your server never delivers directly.selector._domainkey.yourdomain. Sign on your server, or let the relay sign.p=none, quarantine or reject. Mail passes when SPF or DKIM matches the domain in the From header.DMARC became a Standards Track RFC in May 2026: RFC 9989 replaces RFC 7489, and records still start with v=DMARC1.
example.com. MX 10 mail.example.com.
example.com. TXT "v=spf1 include:_spf.relay.example -all"
mail2026._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=<public key>"
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"Bulk and unsolicited mail is not allowed on any Ironatoll server, through any port or relay. Our rules of use list everything that is banned: Spam and bulk email, phishing, malware and botnet control, DDoS and other attacks, scanning or brute-forcing systems that belong to others, booter and stresser services, carding and fraud, child sexual abuse material, cryptocurrency mining and any service to sanctioned people or companies are all forbidden.
Personal and company mailboxes fit, and so does mail your own apps send to their users, for example sign-up confirmations or invoices. The acceptable use policy gives the full rules.
It keeps your mailboxes on a machine you control, but not your mail in transit. Stored mail sits on your own disks, which you can encrypt.
Every message you send passes through the relay, which can read it unless it is end-to-end encrypted. Every recipient's server keeps its own copy. TLS on ports 465 and 587 protects the hop to the relay, not what the relay stores. Ironatoll is run by DomaineGoat LLC, a company registered in Panama, and answers only to Panamanian law. Each server’s datacenter, for its part, is bound by the law of the country it stands in.
See whether your hosting provider can see the data on your server, and what an offshore dedicated server is.
According to Ironatoll's check of 30 October 2026, comparable dedicated servers cost a median of $180.00 across 17 hosts; Atoll 16 costs 65% less. One server can hold a company's mail and its other services, as virtual machines: see how to install Proxmox on a dedicated server. Prices for the five plans: how much an Ironatoll dedicated server costs.
6 cores · 16 GB RAM
$63.68
3 months $171.93 (−10%)6 months $305.66 (−20%)1 year $534.91 (−30%)
6 cores · 32 GB RAM
$72.15
3 months $194.80 (−10%)6 months $346.32 (−20%)1 year $606.06 (−30%)
Best value
8 cores · 64 GB RAM
$72.62
3 months $196.07 (−10%)6 months $348.57 (−20%)1 year $610 (−30%)
In every plan: Whole machine · Root access · RAID 1 on two disks · Dedicated IPv4 · No logs · No KYC
Ironatoll blocks outgoing port 25 on all servers, for good, as an anti-spam rule. Send through a relay on port 587 or 465 instead; the relay delivers on its own port 25.
No. The rule is the same for every server and every plan. A relay on port 587 or 465 delivers legitimate mail just as well.
Receivers check the reverse DNS of the address that connects to them. When you send through a relay, that is the relay's address, and the relay sets it. Custom reverse DNS for your own server is not among Ironatoll's published promises.
Not at Ironatoll: bulk email is not allowed on any plan. Mail from your own apps to your own users, sent through a relay, is fine.
A mail transfer agent such as Postfix, an IMAP server such as Dovecot, a spam filter and a DKIM signer. Add webmail if your users want it, and your own backups, since Ironatoll includes none.
Host your mailboxes on your own machine
Atoll 16: Intel Xeon E-2236 (6 cores / 12 threads), 16 GB RAM, 2 × 480 GB SSD in RAID 1, 30 TB a month at 1 Gbit/s, 1 IPv4 and an IPv6 /64, for $63.68 per 30 days. Ready for a relay: ports 465 and 587 reach mail providers. Pay in crypto; no KYC.
From $63.68/30 days · no KYC
Get a dedicated server