# Can I host a mail server on an offshore dedicated server?

> Can I host a mail server on an offshore dedicated server? Yes to receive; send via a relay on 587 or 465, as outgoing port 25 is closed. No KYC, crypto.

- URL: https://ironatoll.com/mail-server-on-dedicated-server/
- Last updated: 2026-10-30
- Publisher: Ironatoll (https://ironatoll.com)

What works with outgoing port 25 closed, how to send through a relay, and the SPF, DKIM and DMARC records every sending domain needs.

**Quick answer — Can I host a mail server on an offshore dedicated server?**

Yes, you can host a mail server on an offshore dedicated server at **Ironatoll**, with one limit. Outgoing port 25 is closed, so the server cannot deliver mail straight to other servers. It receives mail, stores mailboxes and sends through a relay (smarthost) on port 587 or 465. Servers cost from $63.68 per 30 days, no KYC, paid in crypto. Bulk email is banned.

## What an Ironatoll mail server can and cannot do

| Attribute | Value |
| --- | --- |
| Outgoing port 25 | Port 25 (SMTP) is blocked for outgoing traffic on every server as an anti-spam measure, and the block is permanent. Outgoing connections to mail providers on ports 465 and 587 work normally |
| Receiving mail (MX) | Works: the block covers outgoing connections, so other servers can deliver to yours |
| Sending mail | Through a relay (smarthost) you log in to, on port 587 (STARTTLS) or 465 (implicit TLS) |
| Direct delivery to other servers | Not possible: it needs outgoing port 25 |
| Mailboxes and IMAP | Work: your users read their mail from your server |
| Reverse DNS | Not among Ironatoll's published promises; with a relay, receivers check the relay's address |
| Backups | There are no automatic backups, so every file you need to keep should also live somewhere you control |
| Bulk email | Banned on every plan, through any port or relay |

## Why is outgoing port 25 closed on Ironatoll servers?

To keep spam from leaving the network. Port 25 (SMTP) is blocked for outgoing traffic on every server as an anti-spam measure, and the block is permanent. Outgoing connections to mail providers on ports 465 and 587 work normally.

**Port 25 is where mail servers hand mail to each other; ports 587 and 465 are where senders log in to their provider.** RFC 6409 keeps server-to-server relay on port 25 and reserves port 587 for submission, with a login required by default. RFC 8314 gives port 465 to submission with implicit TLS: encryption starts as soon as the connection opens.

Spam from rented servers leaves on port 25. Closing it protects the reputation of every address in the network, yours included. The rule is the same for every server and every plan.

## Can my dedicated server receive mail?

Yes. The block applies to connections your server opens, not to connections other servers open to it. Point your domain's MX record at your server, and other mail servers deliver to it on port 25.

A typical stack on Debian or Ubuntu:

- **Postfix** receives mail and hands outgoing mail to the relay.
- **Dovecot** stores mailboxes and serves them over IMAP.
- **A spam filter and a DKIM signer**, such as rspamd or OpenDKIM.
- **Webmail**, if your users want it.

Mail is data you cannot rebuild. There are no automatic backups, so every file you need to keep should also live somewhere you control.

## How do I send mail through a relay (smarthost)?

Set your mail server to hand every outgoing message to a relay that you log in to. The relay then delivers on its own port 25. Ironatoll keeps ports 465 and 587 open towards mail providers for this.

Use your mail provider's SMTP submission service, or a transactional relay that accepts your domain. In Postfix, the official SASL guide sets it up in a few lines:

*Postfix: send all mail through an authenticated relay*

```ini
# /etc/postfix/main.cf
relayhost = [smtp.relay.example]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
smtp_sasl_tls_security_options = noanonymous
smtp_tls_security_level = encrypt
# Port 465 instead: relayhost = [smtp.relay.example]:465
# plus smtp_tls_wrappermode = yes (Postfix 3.0 and later)

# /etc/postfix/sasl_passwd  (owned by root, mode 600)
[smtp.relay.example]:587    username:password

# Then: postmap /etc/postfix/sasl_passwd && systemctl reload postfix
# Some systems use hash: or cdb: instead of lmdb:
```

The square brackets stop Postfix from looking up MX records for the relay's name. With `smtp_tls_security_level = encrypt`, your password never crosses an unencrypted link.

## What are SPF, DKIM and DMARC, and do I need them?

Yes: receivers use all three to decide whether mail really comes from your domain. Each one is a DNS record.

- **SPF** (RFC 7208, April 2014) lists the hosts allowed to send mail for your domain, in a TXT record that starts with `v=spf1`. A check may use at most 10 DNS lookups. With a relay, list the relay's hosts: your server never delivers directly.
- **DKIM** (RFC 6376, September 2011) signs each message in a header. The public key sits in DNS under `selector._domainkey.yourdomain`. Sign on your server, or let the relay sign.
- **DMARC** (RFC 9989, May 2026) tells receivers what to do with mail that fails: `p=none`, `quarantine` or `reject`. Mail passes when SPF or DKIM matches the domain in the From header.

**DMARC became a Standards Track RFC in May 2026: RFC 9989 replaces RFC 7489, and records still start with `v=DMARC1`.**

*DNS records for a domain that sends through a relay*

```text
example.com.                     MX   10 mail.example.com.
example.com.                     TXT  "v=spf1 include:_spf.relay.example -all"
mail2026._domainkey.example.com. TXT  "v=DKIM1; k=rsa; p=<public key>"
_dmarc.example.com.              TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
```

## Which mail uses are not allowed?

Bulk and unsolicited mail is not allowed on any Ironatoll server, through any port or relay. Our rules of use list everything that is banned: Spam and bulk email, phishing, malware and botnet control, DDoS and other attacks, scanning or brute-forcing systems that belong to others, booter and stresser services, carding and fraud, child sexual abuse material, cryptocurrency mining and any service to sanctioned people or companies are all forbidden.

Personal and company mailboxes fit, and so does mail your own apps send to their users, for example sign-up confirmations or invoices. The [acceptable use policy](https://ironatoll.com/acceptable-use/ "What is not allowed on an Ironatoll server") gives the full rules.

## Does an offshore server make my email more private?

It keeps your mailboxes on a machine you control, but not your mail in transit. Stored mail sits on your own disks, which you can encrypt.

Every message you send passes through the relay, which can read it unless it is end-to-end encrypted. Every recipient's server keeps its own copy. TLS on ports 465 and 587 protects the hop to the relay, not what the relay stores. Ironatoll is run by DomaineGoat LLC, a company registered in Panama, and answers only to Panamanian law. Each server’s datacenter, for its part, is bound by the law of the country it stands in.

See [whether your hosting provider can see the data on your server](https://ironatoll.com/can-my-host-see-my-data/ "What a host can and cannot see on a rented dedicated server"), and [what an offshore dedicated server is](https://ironatoll.com/what-is-an-offshore-dedicated-server/ "Offshore dedicated servers explained").

## How much does a mail server cost at Ironatoll?

**According to Ironatoll's check of 30 October 2026, comparable dedicated servers cost a median of $180.00 across 17 hosts; Atoll 16 costs 65% less.** One server can hold a company's mail and its other services, as virtual machines: see [how to install Proxmox on a dedicated server](https://ironatoll.com/install-proxmox-on-dedicated-server/ "Proxmox VE on a rented bare metal server"). Prices for the five plans: [how much an Ironatoll dedicated server costs](https://ironatoll.com/pricing/ "Ironatoll plans and prices per 30 days").

| Plan | Quantity | 30 days | 3 months | 6 months | 1 year |
| --- | --- | --- | --- | --- | --- |
| Atoll 16 | 6 cores · 16 GB RAM | $63.68 | $171.93 (−10%) | $305.66 (−20%) | $534.91 (−30%) |
| Atoll 32 | 6 cores · 32 GB RAM | $72.15 | $194.80 (−10%) | $346.32 (−20%) | $606.06 (−30%) |
| Atoll 64 | 8 cores · 64 GB RAM | $72.62 | $196.07 (−10%) | $348.57 (−20%) | $610 (−30%) |

In every plan: Whole machine · Root access · RAID 1 on two disks · Dedicated IPv4 · No logs · No KYC

**Before you pay**

- Minimum top-up $1. Top up once in crypto, then buy any plan from your balance.
- Credit on your balance does not expire and renews any of your servers. When a top-up is only made to reach the minimum, the unspent part comes back on request within 30 days of payment, in USDT or USDC. The rest of a balance is not paid out unless the law requires it.
- Credited once your payment is checked on the blockchain. Typical network confirmation time: BTC ≈ 20 min · USDT TRC-20 ≈ 1 min · USDT ERC-20 ≈ 5 min · USDC ERC-20 ≈ 5 min · ETH ≈ 5 min · SOL ≈ 1 min · LTC ≈ 15 min · XMR ≈ 20 min

## Mail server on a dedicated server: FAQ

### Why can't my dedicated server send mail on port 25?

Ironatoll blocks outgoing port 25 on all servers, for good, as an anti-spam rule. Send through a relay on port 587 or 465 instead; the relay delivers on its own port 25.

### Can I get port 25 opened on request?

No. The rule is the same for every server and every plan. A relay on port 587 or 465 delivers legitimate mail just as well.

### Do I need reverse DNS (PTR) for a mail server?

Receivers check the reverse DNS of the address that connects to them. When you send through a relay, that is the relay's address, and the relay sets it. Custom reverse DNS for your own server is not among Ironatoll's published promises.

### Can I use a dedicated server for email marketing?

Not at Ironatoll: bulk email is not allowed on any plan. Mail from your own apps to your own users, sent through a relay, is fine.

### What software do I need for a self-hosted mail server?

A mail transfer agent such as Postfix, an IMAP server such as Dovecot, a spam filter and a DKIM signer. Add webmail if your users want it, and your own backups, since Ironatoll includes none.

**Host your mailboxes on your own machine** Atoll 16: Intel Xeon E-2236 (6 cores / 12 threads), 16 GB RAM, 2 × 480 GB SSD in RAID 1, 30 TB a month at 1 Gbit/s, 1 IPv4 and an IPv6 /64, for $63.68 per 30 days. Ready for a relay: ports 465 and 587 reach mail providers. Pay in crypto; no KYC. [Order Atoll 16](https://ironatoll.com/app/checkout/?plan=atoll-16&lang=en) · [Compare plans](https://ironatoll.com/pricing/ "How much does an Ironatoll dedicated server cost?")

## Sources

1. [RFC 6409: Message Submission for Mail](https://www.rfc-editor.org/rfc/rfc6409) — RFC Editor (IETF) (November 2011, read 2026-10-30)
2. [RFC 8314: Cleartext Considered Obsolete: Use of TLS for Email Submission and Access](https://www.rfc-editor.org/rfc/rfc8314) — RFC Editor (IETF) (January 2018, read 2026-10-30)
3. [RFC 7208: Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208) — RFC Editor (IETF) (April 2014, read 2026-10-30)
4. [RFC 6376: DomainKeys Identified Mail (DKIM) Signatures](https://www.rfc-editor.org/rfc/rfc6376) — RFC Editor (IETF) (September 2011, read 2026-10-30)
5. [RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc9989) — RFC Editor (IETF) (May 2026, read 2026-10-30)
6. [Postfix SASL Howto: SMTP client authentication and relayhost](https://www.postfix.org/SASL_README.html) — Postfix (read 2026-10-30)

---

Ironatoll: Ironatoll rents offshore dedicated servers (bare metal) in Amsterdam, Reykjavik, Zurich and Bucharest, paid in crypto with no KYC: no ID, no selfie, no documents. Each server is a whole physical machine for one customer, with root access over SSH. It is run by DomaineGoat LLC, a company registered in Panama that ignores DMCA notices, answers only to Panamanian law, allows Tor exit relays and keeps no logs. On the 30-day term, each plan is priced at least 25% under a named comparable dedicated server from 17 no-KYC crypto hosts, read on 30 October 2026.