If your server sends or receives mail, it needs particular attention.
THE RISK
An open relay, a server that will send mail for anyone, is found and abused within hours. Your address is blacklisted and your server becomes a spam source.
CONFIGURATION ESSENTIALS
Require authentication for sending. Never permit unauthenticated relay. Bind administrative interfaces to localhost. Rate-limit outbound mail per account. Configure SPF, DKIM and DMARC for every domain you send for. Set reverse DNS matching the server hostname.
MONITORING
Watch the mail queue. A queue growing rapidly usually means either a compromised account or an abused form.
Watch outbound volume against your normal baseline.
IF YOU ARE BLACKLISTED
Find and stop the source before requesting delisting. Delisting while spam continues is refused and lengthens the process.
THE ALTERNATIVE
Run no mail server at all. Send through a dedicated provider by SMTP, and receive mail elsewhere.
For many VPS deployments this is the better decision. Mail is the most demanding service to run well, and the consequences of running it badly fall on your reputation.
