Google and Yahoo’s 2024 bulk-sender rules pushed thousands of small businesses into the same conversation: SPF, DKIM, and DMARC are not optional anymore. If you send any volume of email from your domain and your records are wrong, your messages land in spam or get rejected outright.
We set the records up correctly on your mail server, rotate the DKIM key, get DMARC to p=quarantine without breaking legitimate senders, and hand you a weekly report so you know what’s still trying to spoof you. Three business days from kickoff to verified DNS, from $290.
Full setup, no upsell to a second tier
Everything below is in the $290 tier. We do the harder work once, hand it over, and you do not pay us monthly to keep records that should not need touching.
- Audit your current DNS — read existing SPF, DKIM, and DMARC records and document what is wrong
- Publish a corrected SPF record covering every legitimate sender, under the 10-lookup limit
- Generate a 2048-bit DKIM key on your mail server (Postfix/OpenDKIM or CyberPanel mail), publish the public half in DNS
- Configure Postfix or the CyberPanel mail engine to sign outgoing mail with the new selector
- Publish a DMARC record starting at p=none with rua and ruf reporting addresses you control
- Set up forensic and aggregate report parsing — we use a simple inbox or a free tier of dmarcian
- Add MTA-STS and TLS-RPT records so receivers know to use TLS and report failures
- Set rDNS (PTR record) on the mail server's IP if your provider lets you, so receivers can verify the reverse lookup matches
- Test from a clean inbox at Gmail, Outlook, and Yahoo to confirm all three pass the authentication checks
- Move DMARC to p=quarantine once a week of reports shows legitimate mail aligning correctly
Working records, plus the doc to maintain them
You get verified DNS records, a parsed first week of DMARC reports, and a written runbook for adding new senders.
Verified SPF, DKIM, and DMARC records
Published in your DNS zone, confirmed via MXToolbox and a Gmail/Outlook/Yahoo round-trip test.
First week of DMARC report parsing
We collect rua reports for the first seven days, summarise who is sending mail as your domain (legitimately and otherwise), and flag anything suspicious.
DKIM key rotation runbook
One-page doc: when to rotate, how to rotate without breaking signatures in flight, how to retire the old selector.
Sender-onboarding checklist
How to add a new transactional sender (e.g. you sign up for HubSpot or switch from Mailgun to Postmark) without breaking SPF.
MTA-STS and TLS-RPT setup
The TLS-side records most setup guides leave out, plus a check that your mail server presents a valid certificate on port 25.
Three steps, three days, then a week of watching
Three business days from kickoff to verified records, then a week of DMARC report parsing before we step back.
Audit current DNS and mail server
We read your existing SPF, DKIM, and DMARC records, check the Postfix or CyberPanel mail config, and write a one-page diff: what is wrong and what we are going to change.
Day 1 — audit delivered same dayPublish records and configure mail server
Corrected SPF, new 2048-bit DKIM key, DMARC at p=none with reporting addresses, MTA-STS and TLS-RPT. We confirm via MXToolbox and a round-trip from Gmail, Outlook, and Yahoo.
Days 2-3 — all records liveParse first week of DMARC reports
Aggregate (rua) reports come in for seven days. We summarise who is sending as your domain and flag what needs to align. If legitimate mail aligns cleanly, we move DMARC to p=quarantine.
Days 4-10 — weekly summary and policy upgradeFixed price, no monthly retainer
The setup tier is $290. That covers DNS audit, corrected SPF, new DKIM key and Postfix signing config, DMARC at p=none with reporting, MTA-STS, TLS-RPT, and the first week of report parsing. After that you own the records and the runbook.
If you are also building or rebuilding the mail server itself (Postfix install on a fresh VPS, Dovecot for IMAP, Let’s Encrypt, rspamd, monitoring), that is the $890 Full Mail Server Build tier — same DKIM/DMARC work plus the whole stack.
Already failing the Gmail 2024 bulk rules?
If your transactional or marketing mail is bouncing from Gmail or Yahoo because of the bulk-sender requirements, we prioritise that path first. We have moved a domain from outright rejection to p=quarantine-clean in five business days when the records were genuinely broken.
- DNS audit and one-page diff
- SPF corrected, under the 10-lookup limit
- New 2048-bit DKIM key, Postfix or CyberPanel signing configured
- DMARC at p=none with rua/ruf reporting
- MTA-STS and TLS-RPT records
- First week of report parsing
- Move to p=quarantine after week-one alignment check
- Postfix and Dovecot installed on your VPS
- Let's Encrypt certificate auto-renewing
- rspamd or SpamAssassin filtering tuned
- Everything in SPF/DKIM/DMARC Setup
- Postscreen for connection-level greylisting
- rDNS configured with your hosting provider
- Basic monitoring (queue depth, deferred mail alert)
Stack we deploy and audit
How this connects to the rest of the stack
This pairs naturally with our WordPress security audit and hardening work. If WordPress is your sending domain (transactional mail, contact forms, WooCommerce receipts), the application layer and the mail authentication layer break in the same kinds of ways and benefit from a single sweep.
For the broader email-deliverability picture across other senders (Workspace, 365, marketing tools), the email deliverability services hub covers the full scope. If you are setting up the Linux server underneath the mail stack from scratch, the Linux server support overview is where to start. Prefer a hosted mailbox to running your own server? Our Google Workspace and Microsoft 365 setup covers that route.
A compromise bad enough to blacklist your mail usually means the box itself needs rebuilding, which is our Linux server recovery job. If you would rather not run a mail server at all, our Google Workspace and Microsoft 365 setup moves you onto hosted email instead.
Prefer to hand the whole thing over as one fixed-price job? See our deliverability fix bundle. A mail server is only as safe as the host under it, so most clients pair this with Linux server hardening. If the mail comes from WordPress rather than the server, we fix WordPress email that lands in spam.
For store platforms specifically, see our OpenCart email setup and Drupal email setup.
If you want the plain-English version first, we broke down what SPF, DKIM, and DMARC each actually do and the safe order to roll them out.
Need mail for Linux Server sorted?
We'll triage the same day. Send context, screenshots, error messages — whatever you have. No sales calls, no chatbots.