Email deliverability

Sending mail is easy; getting it into the inbox is the hard part. Providers like Gmail, Outlook, and Yahoo decide inbox-vs-spam based on how well your mail is authenticated and how much they trust the sending domain and IP. This guide covers everything that matters, in the order it matters.

The four things that decide it

Check	What it proves	Where you set it
PTR (reverse DNS)	The sending IP has a real hostname that points back to it	Your VPS provider (only they can)
SPF	This server is allowed to send for the domain	DNS (TXT record)
DKIM	The message wasn't tampered with and really came from the domain	DNS (TXT record) — key generated by NovaPanel
DMARC	What to do if SPF/DKIM fail, and where to send reports	DNS (TXT record)

Get all four right and you clear the bar every big provider checks. Miss PTR or DKIM and you'll sit in spam — or get rejected outright.

Where NovaPanel helps

The panel generates your DKIM key automatically and shows you the exact SPF/DKIM/DMARC records to publish (Admin → Settings → Notifications shows them for alert mail; the per-customer mail setup shows them for their domains). It also signs every outbound message via OpenDKIM once the key exists. What it can't do for you is set the PTR — that lives at your VPS provider — and it can't publish DNS records that live outside a zone it manages.

Step by step

1. Set the PTR (reverse DNS)

In your VPS provider's control panel (Hetzner, OVH, Contabo, DigitalOcean, etc.), find Reverse DNS / PTR for your server's IP and set it to your mail hostname (e.g. mail.yourdomain.com or your panel hostname). This is the single most common reason mail is rejected — a missing or mismatched PTR fails forward-confirmed reverse DNS, and strict providers like Yahoo reject the message before even scoring it.

The forward-confirm rule: the receiving server looks up your IP's PTR → gets a hostname → resolves that hostname → and the result must include your IP. So the hostname in your PTR must also have an A record pointing back to the same IP.

2. Publish SPF, DKIM, DMARC

NovaPanel shows you the exact records. Publish them as TXT records on the sending domain:

• SPF — e.g. v=spf1 a mx ip4:YOUR.SERVER.IP ~all
• DKIM — a long v=DKIM1; …p=… key at nova._domainkey.yourdomain.com (copy it exactly from the panel)
• DMARC — v=DMARC1; p=none; rua=mailto:postmaster@yourdomain.com; fo=1 at _dmarc.yourdomain.com

Start DMARC at p=none (monitor only). Once you've confirmed legitimate mail passes, you can tighten to p=quarantine for a stronger signal.

3. Verify

Send a test message and check the receiving side's headers — you want to see spf=pass, dkim=pass, and dmarc=pass. For admin alert mail, the panel does this for you: the deliverability check in Admin → Settings → Notifications lights up green/red for SPF, DKIM, DMARC, PTR, and whether the domain resolves directly to your server.

The Cloudflare trap

This catches almost everyone. Cloudflare's proxy (the orange cloud) only carries web traffic (HTTP/HTTPS) — it never proxies mail. If your mail hostname is proxied, it resolves to Cloudflare's IPs, not your server. That breaks two things at once: the PTR can't forward-confirm (Cloudflare's IP ≠ your IP), and SPF alignment falls apart. Result: spam or rejection.

Two ways out:

• DNS-only mail hostname. Keep your web/panel hostname proxied if you like, but give mail its own hostname — e.g. mail.yourdomain.com as a grey-cloud (DNS-only) A record pointing straight at your server IP — and set the PTR to that. Free, full control.
• Send through an SMTP relay. In Admin → Mail Config, point outbound mail at SES, SendGrid, Mailgun, SMTP2GO, or any custom SMTP host. The relay's IPs already have reputation and handle PTR/SPF/DKIM on their side, so you need no PTR at all. All outbound mail — including alerts — flows through it. Simplest option for a fully-proxied setup.

Reputation: why brand-new senders still land in spam

Even with SPF, DKIM, DMARC and PTR all passing, a brand-new domain on a fresh server IP often lands in spam at first — it has no sending history, and providers build trust over time. This is normal and improves on its own as you send legitimate mail. To speed it up:

• Mark early messages "Not spam" and add the sender to your contacts — this trains the provider directly.
• Send consistently rather than in sudden bursts.
• Check your IP isn't on a blocklist (e.g. mxtoolbox.com) — recycled VPS IPs sometimes carry a bad history.

Admin alert emails

NovaPanel can email you important server alerts — updates available, low disk, expiring SSL, a service going down, security events — not the routine day-to-day notifications, so it won't flood your inbox. Turn it on in Admin → Settings → Notifications → "Email me important alerts". They go to your admin email as a branded HTML message.

• Send test — one click sends a test alert so you can confirm it works and see whether it lands in inbox or spam.
• Deliverability check — a live green/red panel for SPF, DKIM, DMARC, PTR, and direct-DNS, with the exact records to publish. This is the fastest way to confirm your mail setup is correct.
• Custom From address — leave blank to send from notifications@ your panel hostname, or set a specific address (useful when your panel hostname is proxied, or when a relay requires a verified sender).
• Alerts are rate-limited — the same alert won't email more than once an hour, with a hard hourly cap, so a flapping service can't spam you.

Everything on this page applies to alert mail too — set the PTR, publish the records, and if you're behind Cloudflare use a DNS-only mail hostname or a relay.