Email Deliverability for Associations: Setting Up SPF, DKIM and DMARC Correctly on Your Own Virtualmin Server

Why email deliverability is crucial for associations

Associations often face the challenge of reliably reaching members and interested parties by email. Whether invitations to meetings, newsletters or important announcements – if these end up in the spam folder, they often go unnoticed. The solution: correct configuration of SPF, DKIM and DMARC on your own Virtualmin server. In this article, we'll show you how to set this up and thereby significantly improve the deliverability of your emails.

What are SPF, DKIM and DMARC?

Before we get into practice, let's briefly clarify the terms:

• SPF (Sender Policy Framework): A DNS record that specifies which servers are allowed to send emails for your domain.
• DKIM (DomainKeys Identified Mail): A cryptographic signature that confirms that an email actually originates from your domain and has not been tampered with.
• DMARC (Domain-based Message Authentication, Reporting and Conformance): A policy that defines how emails that fail SPF or DKIM should be handled.

Together they form a strong foundation for trustworthy email communication.

Prerequisites: Your Virtualmin server and the domain

To set this up, you need:

• A Virtualmin server (e.g. on a virtual server or web hosting package).
• A domain that points to your server (register it if needed via our domain management).
• Access to the DNS management of your domain.

Virtualmin provides built-in tools to configure SPF, DKIM and DMARC. We'll show you how to use them.

Step 1: Set the SPF record correctly

SPF tells other mail servers which IP addresses are allowed to send for your domain. In Virtualmin, you can edit the SPF record under Server Configuration > DNS Records.

A typical SPF record looks like this:

v=spf1 a mx ip4:YOUR_SERVER_IP -all

Explanation:

• v=spf1: Marks the record as SPF.
• a: Allows the IP of the domain (A record).
• mx: Allows the IPs of the MX records.
• ip4:YOUR_SERVER_IP: Explicitly allows your server's IP.
• -all: All other senders are rejected (recommended for strict policies).

Tip: If you also use external services such as newsletter tools, add their IPs or include mechanisms, e.g. include:_spf.example.com.

Step 2: Generate and publish the DKIM key

DKIM signs your emails with a private key; the public key is published in DNS. In Virtualmin, go to Email Settings > DKIM and click "Generate Key". Virtualmin automatically creates a DNS record.

Make sure the DKIM record is present in your DNS zone. You'll find it under DNS Records as a TXT record with the name default._domainkey (or similar).

The record should look roughly like this:

default._domainkey IN TXT ( "v=DKIM1; k=rsa; p=MIGfMA0GCSq..." )

Important: The private key stays on the server and must never be publicly accessible.

Step 3: Define the DMARC policy

DMARC specifies how recipients should handle emails that fail SPF or DKIM. You create it as a TXT record under _dmarc.

A recommended starting point:

v=DMARC1; p=none; rua=mailto:dmarc@your-domain.com; ruf=mailto:dmarc@your-domain.com; fo=1

Explanation:

• p=none: No action, but collect reports (monitoring).
• rua: Address for aggregate reports.
• ruf: Address for forensic reports.
• fo=1: Reports on failed authentication.

After a test phase, you can tighten the policy to quarantine or reject to prevent abuse.

Step 4: Test and monitor

After setup, you should test your email configuration. Send a test email to a service like mail-tester.com and check the results. Look for SPF and DKIM pass as well as DMARC compliance.

Monitor the DMARC reports regularly to detect misconfigurations or abuse. Virtualmin does not offer integrated DMARC evaluation, but you can receive the reports by email and analyze them with tools like Postmark DMARC.

Additional tips for better deliverability

• Reverse DNS (PTR): Make sure your server's IP has a PTR record that points to your domain. Many mail servers check this.
• Correct HELO/EHLO: The server should identify itself with a valid hostname.
• No open relays: Configure your mail server so that it cannot be abused as an open relay.
• High-quality content: Avoid spam-typical words and only send to recipients who have consented.
• Regular maintenance: Keep your server and mail software up to date.

Conclusion: Succeed with the right configuration

Setting up SPF, DKIM and DMARC on your Virtualmin server is no witchcraft, but it does require care. As an association, you benefit from a significantly higher delivery rate for your newsletters and invitations. Use the tips provided and test regularly to ensure your emails arrive where they should: in your members' inboxes.

If you don't yet have a suitable server, take a look at our web hosting packages or virtual servers – ideal for associations that want to take their email communication into their own hands.