Free tools Windows power users keep installed
One-click scans. No signup required.
Run the website and email system on two independently addressed VPS instances: nginx or Apache2 on the web VPS, and Postfix with Dovecot on the mail VPS. Use separate hostnames, DNS records, firewalls, credentials, queues, backups, and monitoring. The key dependencies are a static public IP, working reverse DNS for the mail address, permitted SMTP traffic, valid TLS certificates, and correctly aligned A/AAAA, MX, SPF, DKIM, and DMARC records.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the two-VPS design looks like
Assume the domain is example.com. The web server might be named www.example.com or use the bare domain, while the mail server uses a dedicated hostname such as mail.example.com. The web VPS serves HTTP and HTTPS traffic. The mail VPS transfers messages with Postfix and stores and exposes mailboxes with Dovecot over IMAP or POP3.
As an Amazon Associate I earn from qualifying purchases.
The website’s A and AAAA records point to the web VPS. The mail hostname’s A and AAAA records point to the mail VPS. The domain’s MX record points to mail.example.com, never directly to an IP address. The provider should set the mail VPS’s reverse-DNS/PTR record to mail.example.com as well. Forward DNS, reverse DNS, the SMTP greeting hostname, and the certificate name should agree.
Why split the services
- A compromise or resource spike on the web host does not automatically expose mailbox data or the mail queue.
- Mail-specific firewall rules, logs, updates, backups, and abuse controls can be managed without changing the web stack.
- Website deployments and mail maintenance can be scheduled independently.
- Each server can be restored from its own backup set, reducing the chance that one failure removes both site and mail data.
Separation does not remove operational work. You still have to maintain two operating systems, two security perimeters, two certificate sets, and a mail reputation. If your provider blocks direct SMTP delivery or you cannot manage reputation, retain the mail VPS for mailbox access but send outbound messages through an SMTP relay.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose VPS instances and a network design
Requirements for both hosts
- Use a distribution receiving current security updates. Keep the web and mail operating systems on supported releases.
- Assign a static public IPv4 address to each VPS. Add IPv6 only when the provider supplies stable addressing and you will configure, test, monitor, and secure it.
- Confirm that inbound SMTP on TCP port 25 and outbound SMTP delivery are allowed. Some providers restrict port 25 or require an abuse review before unblocking it.
- Confirm that you can set reverse DNS/PTR for the mail address, either in the provider panel or through support.
- Check whether snapshots are application-consistent, how long they are retained, and whether private networking is available for administration or backups.
Provider comparison checklist
| Criterion | What to verify | Why it matters |
|---|---|---|
| Static addressing | Dedicated IPv4 allocation and documented IPv6 behavior | DNS records and reputation depend on stable addresses. |
| Reverse DNS | Self-service PTR editing or a support process with a clear turnaround | Receiving mail systems commonly inspect the sending address’s reverse name. |
| SMTP policy | Inbound port 25, outbound port 25, rate limits, and abuse procedures | A technically correct server cannot deliver directly if the provider filters SMTP. |
| Firewall and private network | Stateful firewall rules, IPv6 controls, and private links between instances | Limits exposure and can keep administration or backups off the public path. |
| Backups | Snapshots, off-host backups, retention, and restore testing | Mailboxes, queues, website files, and databases have different recovery needs. |
| DNS tooling | A, AAAA, MX, TXT, DKIM, and DMARC support with low TTL control | Mail and web changes require several record types. |
| Abuse response | Notification channels and account-lock procedures | A compromised mailbox or web script can damage the sending reputation quickly. |
| Certificate automation | Ability to run an ACME client and reload services after renewal | Expired certificates interrupt HTTPS and mail-client connections. |
Harden both VPS hosts before installing services
- Update the operating system. Apply all available security updates and reboot when the kernel or core services require it.
- Create an administrator account. Use a non-root account with controlled administrative privileges. Keep the provider’s emergency console available in case SSH configuration locks you out.
- Install an SSH key. Test a second SSH session with the key before disabling password authentication. Disable password SSH where practical and prohibit direct root login over SSH.
- Enable a host firewall. Start with a deny-by-default policy and add only the ports each role needs. Keep an already-tested SSH session open while changing firewall rules.
- Separate administration from public services. Restrict SSH to known source networks when feasible. Do not expose database, cache, or mailbox-management ports publicly.
- Set time and logging. Correct time is important for log correlation, certificate validation, and authentication. Forward logs to a separate system when possible.
Port plan
| Port | Web VPS | Mail VPS | Purpose |
|---|---|---|---|
| 22/tcp | Restricted | Restricted | SSH administration. |
| 80/tcp | Public | Only if needed for ACME HTTP validation | HTTP and certificate validation or redirect to HTTPS. |
| 443/tcp | Public | Only if the mail host serves a web interface | HTTPS. |
| 25/tcp | Closed | Public as required | Server-to-server SMTP; never use it as an unauthenticated user-submission port. |
| 587/tcp | Closed | Public | Authenticated message submission with TLS. |
| 465/tcp | Closed | Optional, if configured | Implicit-TLS submission. |
| 143/993 and 110/995 | Closed | Expose only the protocols you actually support | IMAP and POP3, with their TLS variants. |
Do not open every listed port automatically. For example, disable POP3 if all clients use IMAP, and expose only 993 instead of unencrypted 143 when your client policy permits it.
Install and publish the web VPS
Install nginx or Apache2
Ubuntu supports both nginx and Apache2. Choose one primary web server unless you have a deliberate reverse-proxy design. Install it from the distribution repositories, enable it at boot, and verify that it serves a temporary page before adding the production site.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemssudo apt update
sudo apt install nginx
sudo systemctl enable --now nginxFor Apache2, install the Apache2 package and enable its service instead. Create a virtual host for the domain, set the document root, configure the application runtime if needed, and keep secrets outside the document root. Validate the configuration before reloading the service.
Point the web DNS records
Create an A record for the site that contains the web VPS IPv4 address. If IPv6 is enabled, create an AAAA record with the web VPS IPv6 address. Add any required records for www separately or use a CNAME that ultimately resolves to the web host. Do not point the site records at the mail VPS.
Wait for the records to resolve from networks outside your provider. Only then request the production web certificate and switch application traffic to HTTPS.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Install Postfix and Dovecot on the mail VPS
Install the mail transfer agent
Postfix handles SMTP transfer and queue management. On Ubuntu, the basic installation is:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →sudo apt update
sudo apt install postfixDuring setup, select the server type that matches a system receiving and sending mail for its own domain, then set the system mail name deliberately. Confirm the server’s fully qualified hostname, for example mail.example.com, before editing Postfix settings.
Install mailbox access and delivery components
Dovecot provides mailbox access over IMAP or POP3 and can provide the SASL authentication socket that Postfix uses for authenticated submission. Install the Dovecot packages for the protocols and mailbox format you intend to support. Disable unused protocols rather than leaving extra listeners active.
Decide how mailboxes map to users: local system accounts, virtual users, or an external identity store. The choice affects directory ownership, password storage, quota handling, and backup procedures. Use a mailbox format supported by both Postfix delivery and Dovecot, and test permissions with a non-privileged mailbox account.
Set the accepted domain and hostname
Configure Postfix to accept mail for example.com, identify itself as mail.example.com, and deliver only to valid local or virtual recipients. Recipient restrictions must reject unknown recipients during the SMTP transaction; accepting arbitrary recipients and bouncing them later creates backscatter and makes abuse easier.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Publish the DNS records that join the services
| Record | Example target | Role and checks |
|---|---|---|
| A | example.com and/or www.example.com → web VPS IPv4 |
Routes website requests to the web host. |
| AAAA | Web hostnames → web VPS IPv6 | Publish only if IPv6 is reachable and filtered correctly. |
| A | mail.example.com → mail VPS IPv4 |
Resolves the mail hostname used by MX and clients. |
| AAAA | mail.example.com → mail VPS IPv6 |
Ensure Postfix actually listens and has equivalent firewall rules before publishing. |
| MX | example.com → mail.example.com |
Directs inbound mail to the mail host. The MX value must be a hostname, not an IP literal. |
| TXT (SPF) | Policy for the systems authorized to send | Include the mail VPS and any approved relay or application sender; keep one SPF record for the domain. |
| TXT (DKIM) | Selector-specific public key | Publish the key that corresponds to the signing service and selector configured on the mail VPS. |
| TXT (DMARC) | Policy at _dmarc.example.com |
Choose reporting and enforcement settings that match your SPF/DKIM rollout. |
| PTR | Mail VPS IP → mail.example.com |
Set by the VPS provider; verify reverse lookup externally. |
Check both directions from outside the provider network. The mail hostname should resolve to the mail address, and the mail address should reverse-resolve to the same hostname. If you publish IPv6, test delivery over IPv6 rather than assuming it behaves like IPv4.
Issue certificates for web and mail names
Use an ACME client such as Certbot for the web hostname and mail.example.com. The web server can use the client’s nginx plugin when nginx is installed. Store certificates with the client’s normal layout, such as /etc/letsencrypt/live/mail.example.com/, and grant services access through the client-managed links rather than copying private keys into application directories.
Configure nginx or Apache2 to serve the certificate for the site. Configure Postfix’s SMTP TLS settings and Dovecot’s IMAP/POP3 TLS settings to use the certificate and private key for the mail hostname. A client connecting to mail.example.com must see a certificate containing that exact name.
Most ACME installations install an automatic renewal timer. Verify it with a simulation:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutesudo certbot renew --dry-runUse a renewal deploy hook to reload nginx, Postfix, and Dovecot after a successful renewal. Reload, rather than restart, when supported so existing connections and queued mail are disrupted as little as possible.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Configure authenticated SMTP and TLS
Keep server-to-server SMTP separate from submission
Port 25 is for mail transfer between servers. Port 587 is for authenticated users and applications. If you offer port 465, configure it explicitly for implicit TLS. Do not allow ordinary users to relay anonymously through port 25.
Connect Postfix to Dovecot SASL
Enable Postfix SMTP authentication through Dovecot’s SASL socket. The effective configuration must include settings equivalent to:
Recommended Free Tools
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymousSet recipient restrictions so unauthenticated clients may deliver only when they are receiving mail for domains hosted on the server, while authenticated users may submit outbound mail. Permit trusted internal networks only when you can identify and secure every device on them.
Require encrypted client connections
Use TLS for submission and mailbox access. Opportunistic TLS can be enabled for server-to-server SMTP, while authenticated submission should not permit credentials to travel over a plaintext connection. Select modern protocol and cipher settings supported by your operating system and clients, and remove obsolete protocols as your compatibility requirements allow.
Postfix also supports DNSSEC and TLSA records for operators who choose authenticated mail-server-to-mail-server delivery through DANE. This is an advanced design: TLSA records must match the MX hostname and the certificate or public-key strategy, and incorrect records can make delivery fail. Do not publish TLSA records until DNSSEC signing, certificate rotation, and recovery procedures are tested.
Test every dependency before launch
- Check DNS. Query the web A/AAAA records, the mail A/AAAA records, the MX target, SPF, DKIM, and DMARC records from an external network. Confirm the MX target is the intended mail hostname.
- Check reverse DNS. Look up the mail VPS address and verify that PTR returns the same hostname Postfix uses in its SMTP banner.
- Check HTTPS. Browse the site by its production hostname, confirm the certificate name and chain, and verify that HTTP redirects or serves only what you intend.
- Check mail certificates. Connect with an IMAP or POP3 client using the mail hostname and confirm that the certificate is valid without a hostname warning.
- Check mailbox login. Test a real mailbox over encrypted IMAP or POP3. Verify that users cannot read another mailbox and that failed logins are logged and rate-limited.
- Check authenticated submission. Submit a message through port 587 with valid credentials, then repeat with invalid credentials. The first should be accepted and the second rejected without exposing whether unrelated accounts exist.
- Check inbound delivery. Send from an external account to a mailbox hosted on the VPS. Confirm Postfix accepts only hosted recipients and that Dovecot exposes the delivered message.
- Check outbound delivery. Send to an external recipient and inspect the received headers for the expected sending hostname, SPF result, DKIM signature, and DMARC alignment.
- Check queue behavior. Temporarily test a destination that is unavailable, observe that Postfix queues the message, then restore connectivity and confirm delivery. Do not delete a queue merely to hide an error.
- Check relay protection. From an unauthenticated external connection, attempt to send to an outside recipient. The server must refuse to relay.
- Check renewal. Run the ACME dry-run and verify that the deploy hook reloads each service successfully.
Backups, monitoring, and ongoing operations
Back up the two roles independently
Back up website files, databases, web configuration, mailboxes, Postfix configuration, Dovecot configuration, DKIM keys, and DNS-zone data according to their different recovery requirements. Keep at least one copy off the VPS provider. Encrypt backups, restrict access to private keys, and perform restoration tests rather than relying on successful backup jobs alone.
Monitor the signals that indicate trouble
- SMTP rejection rates, delivery deferrals, queue size, and queue age.
- Disk usage and inode usage on the mail VPS, where a full filesystem can stop both delivery and authentication.
- Authentication failures, password-spray patterns, new administrator keys, and unexpected configuration changes.
- Web error rates, certificate expiry, process health, and database capacity on the web VPS.
- DNS changes, failed certificate renewals, and IPv6 reachability after network changes.
Prepare a rapid response for compromised accounts: disable the account, revoke or change its credentials, stop queued abusive messages, inspect logs, and notify the provider if an address has been listed or rate-limited. Re-enable service only after the entry point is fixed.
Common failures and practical fixes
Mail is delivered to the wrong host
Inspect the domain’s MX records and the mail hostname’s A and AAAA records. Remove stale MX entries, correct the target hostname, and lower the TTL before a planned migration. Remember that changing the website A record does not change mail routing.
Remote servers reject outbound mail
Check that port 25 is permitted, PTR matches the SMTP hostname, forward DNS resolves correctly, and the server presents a valid certificate. Review SPF, DKIM, and DMARC alignment, inspect the rejection reason in Postfix logs, and contact the provider if the address is blocked or has a poor reputation. Use a relay when direct delivery is not workable.
Users can receive mail but cannot submit
Verify that port 587 is reachable, Postfix has SMTP-AUTH enabled, Dovecot’s SASL socket path and permissions match Postfix, and the client is configured for authentication with TLS. Check whether the account is allowed to submit and inspect authentication logs for a wrong password, disabled account, or time mismatch.
Certificates renew but clients still see the old certificate
Confirm the renewal wrote the expected files, then check the deploy hook and service logs. Reload Postfix and Dovecot explicitly if the hook failed. Test the public endpoint again; a renewed file is not active until the process has reloaded it.
IPv6 causes intermittent delivery
If an AAAA record exists, many clients will try IPv6 first. Verify routing, firewall rules, reverse DNS, and Postfix listening addresses on IPv6. Remove the AAAA record until IPv6 is fully operational rather than leaving a broken path published.
When an SMTP relay is the better choice
Direct delivery is appropriate only when you can maintain reverse DNS, port-25 access, authentication security, SPF/DKIM/DMARC, queue monitoring, and reputation. Choose an SMTP relay for outbound mail when the provider blocks port 25, assigns an address with poor reputation, imposes restrictive rate limits, or cannot provide reverse-DNS control. The mail VPS can still host mailboxes and receive inbound mail; configure Postfix to route outbound messages through the relay and publish the relay’s sending authorization in SPF and DKIM design.
Quick Recap
Launch checklist
- Two current, patched VPS instances have static addresses and tested SSH access.
- The web host serves the site; the mail host identifies itself as
mail.example.com. - Web A/AAAA records point only to the web VPS, and mail A/AAAA records point only to the mail VPS.
- The domain MX points to the mail hostname, and PTR points back to that hostname.
- Postfix accepts hosted recipients, Dovecot serves the intended mailbox protocols, and unauthenticated relay is blocked.
- Submission uses authentication and TLS; mailbox access uses encrypted connections.
- SPF, DKIM, and DMARC records match the actual sending design.
- Certificates cover every public hostname, renew automatically, and reload all dependent services.
- Queues, logs, disk usage, authentication failures, and certificate expiry are monitored.
- Website and mail backups are separate, encrypted, off-host, and restorable.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
