Confirm whether this server provides mailboxes or only hosts the website. Record the public sending address, intended mail hostname, authoritative DNS provider and all legitimate senders. Ensure the server administrator has configured its mail service and authorized outbound delivery.

1. For locally hosted mail, create the required mailboxes and publish an MX record pointing to the actual mail hostname. Give that hostname a valid address record and keep it outside a web-only proxy path.
2. Arrange the server sending-IP reverse DNS with the IP provider and ensure the SMTP identity is appropriate. Editing a normal forward zone does not set the provider PTR record.
3. Publish one SPF policy that includes the legitimate senders. Do not add a second independent SPF record when another service also sends for the domain.
4. Have the administrator enable supported DKIM signing and inspect the generated selector and public key. Publish the exact public DNS record at the authoritative provider; keep the private key on the authorized signing server.
5. Introduce DMARC according to the domain mail policy, first verifying legitimate sender alignment and reporting before enforcing a restrictive policy.
6. If mail is external, publish that provider MX and authentication records and configure local delivery so same-server messages are routed appropriately. Do not create competing local mailboxes as a substitute for routing configuration.

The external provider signs messages it sends through its own infrastructure. Configure that provider authorized sender and DKIM records separately; a local signing key does not automatically apply to those messages.

Send to an external recipient and inspect authentication results in the received headers. Send a reply from outside and confirm it reaches the intended mailbox. Query the authoritative MX and DKIM TXT records directly when results differ from the panel.

If mail fails, use the SMTP response and mail logs to distinguish DNS, authentication, recipient and reputation problems. Passing SPF or DKIM alone does not guarantee inbox placement. Avoid relaxing all authentication policy to hide a misconfigured legitimate sender.

• Making a Virtualmin BIND zone authoritative
• Creating limited users in Virtualmin
• Requesting and renewing a certificate in Virtualmin
• Fixing a Virtualmin domain that shows the wrong website

• Virtualmin: DKIM
• Virtualmin: Troubleshooting DNS
• Virtualmin: Troubleshooting Emails