Self-hosting mail for the fifth time — which host doesn't have a poisoned range?

Fifth attempt at this and I've run out of the usual explanations.

Every time, the pattern is the same. Fresh box, SPF, DKIM, DMARC, reverse DNS matching, warm-up over three weeks, sensible volume. Delivery is fine for a month and then Microsoft starts silently dropping and Gmail starts spam-foldering, and nothing I changed caused it. Twice I've traced it to a neighbour in the same /24 doing something stupid, which is not a thing I can fix from inside my own box.

So the question is really about the provider's ranges rather than the provider: who has address space that isn't already burnt, and how would I even check before paying? I don't want another three weeks of warm-up to find out.

Transactional or outbound cold? Completely different problem and you haven't said.

Transactional. Receipts, password resets, a weekly digest people opted into. Nothing cold, nothing bought.

IME the honest answer for transactional is don't. I say that as someone who ran his own MX for nine years and stopped last spring.

The reason isn't the software. Postfix is fine, it's been fine for twenty years. The reason is that inbox placement is now a reputation product and reputation is priced per IP, and you are competing against senders who have a full-time deliverability person and a decade of history on their ranges. You can do everything right and lose to a neighbour.

If it's genuinely only receipts and resets, the failure mode of a spam-foldered password reset is a support ticket from someone locked out of their account, which is the most expensive kind of email to get wrong.

I know that's not the answer to the question asked. It's the answer I wish someone had given me at attempt three.

To answer what you actually asked: you can check, and you should check before you pay rather than after.

Ask support for the specific /24 the box will land in — a decent provider will tell you, and one that won't has told you something too. Then look the range up on the usual blocklists and, more usefully, check whether the whole range appears on Spamhaus's policy lists rather than just individual IPs. A single listed neighbour is normal. A policy-level listing on the range means the range is dead for mail and no amount of warm-up saves it.

On providers: 1984 in Iceland has reasonably clean space and a long history, and mail is a normal thing for their customers to do. ExtraVM I'd check per-region, the ranges vary a lot. FlokiNET I would not use for outbound mail at all, and this isn't a criticism of them — a host whose selling point is that they ignore abuse complaints is definitionally hosting people who generate abuse complaints, and you are sharing a neighbourhood with them.

That last point is the one people don't want to hear. Bulletproof and deliverable are close to opposites.

That framing is worth the thread on its own and I hadn't put it that plainly to myself. I've been buying for one property and expecting the other.

And your MX is a permanent, public, timestamped record of which box you own, pointed at by a DNS record you signed. Every hop adds a header. Worth knowing if the reason you're self-hosting was privacy rather than control.

Also check the IP have no history before. Provider recycle IP, you get one from someone who send casino spam six month, and is not your fault but is your problem.

Ran my own mail from about 2009 and gave up in 2019. The thing that changed isn't technical, it's that the two big inbox providers stopped treating an unknown sender as neutral and started treating it as suspicious. That's the whole story. There is no configuration that beats it, only history you don't have.

Since a couple of people asked me in messages, here's what I've settled on, written up properly because the split is the useful bit.

The split

Not all mail is the same and treating it as one system is why this keeps failing.

1. Anything a locked-out user is waiting for — password resets, login codes, receipts. This goes out through a provider with existing reputation. Full stop, no ideology. The cost of a spam-foldered reset is a human being unable to use the thing they paid for.
2. Anything I'm content to have arrive eventually — digests, notifications, internal alerts. Self-hosted, my box, my range, and if Microsoft grey-lists it for a week I'll live.

That division is not a compromise, it's just accurate about what the mail is for.

Checking a range before you buy

• Ask support for the /24 in writing before ordering. Half will tell you.
• Check the range, not the IP, on Spamhaus policy lists. Individual listings are noise; a policy listing is a verdict.
• Ask how long since that address block was last reassigned. Recycled space carries its previous tenant's history and nobody volunteers this.
• Send one message to a seed address on each major provider from the box on day one, before any warm-up, and read the full headers. If you're already in a folder on day one, cancel and get a refund.

On the providers themselves

1984 has behaved well for me for the low-stakes half and their space is calm. PRQ is fine technically but at €30 you're paying for legal hardening you don't need for a digest. Anything marketed as ignoring abuse complaints is the wrong tool for outbound mail regardless of price, per byte_broker above, and that was the piece I'd been getting wrong for five attempts.

I have not tested this split under real volume yet — my digest list is four thousand people, which is nothing.

Short version: stop asking which host has clean space and start asking which of your mail can afford to be late.

Reasonable. Though "ask support for the /24" assumes support answers, and in this corner of the market that assumption has cost people money before.

Four months on. The split has held and I have not thought about deliverability since August, which is the first time that sentence has been true in three years.

One correction to my own post: the seed-address test on day one caught nothing useful. Both of the ranges I've used since looked fine on day one and one of them degraded in week six anyway. The test has no false positives and plenty of false negatives, so treat a pass as meaningless and a fail as decisive.