How to secure a mail server

Updated 7/20/2026

An open mail server (open relay) is immediately exploited to send spam, and your IP ends up on blacklists. Securing it is mandatory.

1. Do not be an open relay

The server must accept sending only from authenticated users. Verify that it does not relay messages from anyone.

All connections (SMTP, IMAP) must be encrypted. Use a valid certificate, see free SSL certificate.

Sending (port 587) requires a username and password. Use strong passwords for each mailbox.

Open only the email ports and protect them from attacks, see fail2ban and UFW.

Put a per-account hourly message limit, so a compromised account cannot send thousands of spam messages.

Add filtering for incoming and outgoing messages, see spam filtering with Rspamd.

Keep software up to date, see automatic security updates.

EU cloud servers, billed hourly, ready in minutes, with one-click installs for dozens of apps.

Rspamd is a modern, fast spam filter. Here is how to use it to keep your inbox clean.

An SMTP relay sends your emails through a service with good reputation, ideal for apps without their own mail server.

Check whether your emails reach the inbox and what spam score they have, with free tools.