Today, email is commonplace — almost everyone uses it and doesn’t think about how it works. A bit like how you normally drive to work in your car. You don’t need to know how the car works to drive.
It’s almost the same with email — it just works…
Over the years I have seen things change quite a bit on the provider side. There are more and more requirements that you must meet if you want to reach a hotmail.com address, for example. Microsoft is known for being particularly strict when receiving mail. It seems that they had to set those rules to keep out all kinds of nonsense and malicious emails with attachments. (I wonder why…)
So when I decided to put Brainfusion.nl on a VPS — web server, database server and mail server all independently — I had not yet taken into account how VPSs have come to be seen in a bad light. Many individuals who wanted to cause mischief have apparently done so on VPSs: spam mailer services, botnets and worse.
To reveal the result: yes, it worked — the email works.
For the technical folks interested in what’s involved — read below:
Port 25 — Step-by-step plan: mail server completely independent
Executed: 2026-06-16 | Server: FS1-1COINH (167.233.171.25)
Initial situation
- Gate 25 open (Hetzner approved)
- Postfix active, relay host still via an external relay
- Abundomy mailer still configured on external relay
- Deliverability stack already ready: PTR ✓ SPF ✓ DKIM ✓ DMARC ✓ MX ✓
Goal
Outgoing mail is sent entirely via Postfix mail.brainfusion.nl, without dependence on an external relay. The Abundomy app also sends email verifications through its own server.
✅ Step 1 — Check IP reputation
Purpose: Check if the server IP is on spam blocklists before we remove the remote relay.
| Block list | Status |
|---|---|
| Spamhaus ZEN/SBL/XBL/PBL | ℹ️ Query rejected — normal for data center IPs without a subscription |
| Barracuda BRBL | ✅ Clean |
| SORBS | ✅ Clean |
| SpamCop | ✅ Clean |
| Abusix | ✅ Clean |
| UCEProtect L1 | ✅ Clean |
| UCEProtect L2 (netblock) | ✅ Clean |
| Validity/ReturnPath | ✅ Clean |
| Microsoft SNDS | ℹ️ Required account — manual check via postmaster.Microsoft.com |
Conclusion: IP reputation clean. No blockers for direct transmission.
✅ Step 2 — Deliverability drought test via mail-tester.com
Objective: Measure baseline score while the remote relay is still active.
A test email sent via mail-tester.com — score with relay: 6,2 / 10.
| Finding | Cause |
|---|---|
| −3 “sender address not allowed” | The relay IP is not in the SPF record of Brainfusion.nl |
| Check DMARC policy state | p=none = monitoring mode, no enforcement |
| −0.8 SpamAssassin | Small penalty sum, partly relay related |
Expected score after relay removal: ~9,2 / 10 — it got even better (see step 5).
✅ Step 3 — Remove Relayhost from Postfix
Goal: From now on, Postfix delivers directly via port 25, without an intermediate station.
postconf -e 'relayhost='
sed -i '/reikiwereld/d' /etc/postfix/sasl_passwd
postmap /etc/postfix/sasl_passwd
systemctl reload postfixResult: relayhost empty ✅ · SASL credentials removed ✅ · Postfix reload ✅
✅ Step 4 — Direct test email to Gmail + headers check
Purpose: Confirm mail is arriving and email headers are correct without a relay intermediary.
Test email sent from patrick@brainfusion.nl to Gmail. Control via “View original”:
- Inbox (not spam) ✅
- SPF: PASS ✅
- DKIM: PASS —
d=brainfusion.nl✅ - DMARC: PASS ✅
- No external relay hop in the Received chain ✅
- TLS 1.3 to Gmail ✅
- Delivery time: 0 seconds ✅
✅ Step 5 — mail-tester.com score after immediate sending
Objective: Compare with the baseline from step 2 and confirm the improvement.
🎯 10 / 10
Perfect score after relay removal — all checks green. Better than expected.
✅ Step 6 — Convert Abundomy-mailer to your own server
Purpose: The Abundomy app sends email verifications through its own server instead of the external relay.
| Parameter | Old | New |
|---|---|---|
SMTP_HOST |
mail.reikiwereld.eu | mail.brainfusion.nl |
SMTP_USER |
noreply@reikiwereld.eu | noreply@brainfusion.nl |
MAIL_FROM |
noreply@reikiwereld.eu | noreply@brainfusion.nl |
SMTP_TLS_INSECURE |
1 | (removed) |
Result: SMTP authentication tested with Python → Sent OK ✅
✅ Step 7 — Test Abundomy Mailer
Purpose: Confirm that the Abundomy app is still sending email verifications to end users.
- Verification email arrived ✅
- Sender:
noreply@brainfusion.nl✅ - ⚠️ Mail ended up in the spam folder — expected for a new shipping address with no reputation history. Improves naturally after several episodes.
✅ Step 8 — Test WordPress contact form
Purpose: Confirm that the WordPress system mail still works after the changes.
- Mail arrived ✅
- ⚠️ Spam folder — WordPress sent as
wordpress@brainfusion.nl, an unknown return address - Fix applied: sender set to
patrick@brainfusion.nlwith name “Brainfusion” ✅
✅ Step 9 — Update SRV and autoconfig DNS
Purpose: automatically configure email clients such as iPhone, Outlook and Thunderbird via Brainfusion.nl.
| DNS record | Value |
|---|---|
autoconfig (A) |
167.233.171.25 ✅ |
_imaps._tcp (SRV) |
0 100 993 mail.brainfusion.nl. ✅ |
_submission._tcp (SRV) |
0 100 587 mail.brainfusion.nl. ✅ |
_pop3s._tcp (SRV) |
0 100 995 mail.brainfusion.nl. ✅ |
_autodiscover._tcp (SRV) |
0 100 443 mail.brainfusion.nl. ✅ |
Autoconfig XML available at https://brainfusion.nl/.well-known/autoconfig/mail/config-v1.1.xml ✅
✅ Step 10 — Removed all external dependencies
Goal: no longer any reference to the external relay in configuration or DNS.
- Postfix SASL credentials cleaned up ✅
- Abundomy mailer configured on own server ✅
- Abundomy libp2p bootstrap entry removed ✅
- Mail queue empty ✅
- DNS SRV/autoconfig updated ✅
- Old DKIM record (
default2606._domainkey) removed from DNS ✅
End result: mail and IPFS completely independent. Removed all external dependencies.