Email deliverability

Every PlusPanel server can send its mail through the PlusPanel mail relay: a sending service run by us, in the EU, on dedicated addresses whose reputation we watch around the clock. Your servers never need their own port 25 or their own IP reputation, and a cloud provider that blocks port 25 does not matter.

How a message travels

1. A mailbox on your server sends a message. The server’s mail service hands it to the relay over the encrypted PlusPanel network (WireGuard), authenticated with the server’s own identity. The relay has no public submission port.
2. The relay checks it: sending limits, a spam filter (rspamd) and your daily quota.
3. It adds a second DKIM signature (d=relay.pluspanel.net) on top of your domain’s own, and delivers it from an address of the right IP pool, over TLS, to the recipient’s mail server.
4. Bounces and spam complaints come back to the relay, which turns them into reports in your panel and a notification to the sender.

Authentication: SPF, DKIM and DMARC

• DKIM: your server signs with your domain’s key; the relay adds its own signature. Recipients see two valid signatures; your domain’s signature is the one DMARC aligns on.
• SPF: your domain’s SPF record includes _spf.pluspanel.net, which always lists the relay’s current addresses. When we add or replace addresses, nothing changes on your side.
• DMARC: passes through your domain’s aligned DKIM signature. The panel publishes a DMARC record with the policy you choose (none, quarantine, reject).
• Return path: bounces go to an address of the relay (bounces.relay.pluspanel.net), so we can match every bounce to the message and the recipient that caused it.

IP pools and warming

Senders are grouped so that one sender’s behaviour cannot hurt everyone else’s delivery:

Pool	Who sends from it
Warming	New servers and new organizations, during their first 30 days, with a daily cap that grows every day
Standard	Everyone after warming
Trusted	Senders with 90 days of clean history: bounces under 2 % and no spam complaint
Dedicated	Enterprise organizations with their own address

Moves between pools are automatic (every night) and can also be made by our team. New relay addresses warm up too: they start with a small daily volume for 30 days.

TLS, always

The relay never delivers mail in plaintext. It uses DANE when the recipient’s domain publishes it (DNSSEC + TLSA) and enforces MTA-STS policies; other servers get encrypted TLS without certificate checks, as the standard allows. A recipient server that offers no TLS at all gets no mail from the relay: the sender receives a bounce.

Bounces and complaints

• Bounces (unknown address, full mailbox, rejected message) appear in Email → Deliverability, per domain, with the reason the recipient’s server gave. The sender also gets the usual “undelivered mail” message.
• Complaints: when a recipient marks a message as spam at a provider with a feedback loop, the relay records it. A complaint suspends sending from that address and notifies your administrators; an organization administrator can lift the first suspension after checking the mailbox (a stolen password is the usual cause). A second suspension within 7 days is lifted by our team.
• Messages rejected as spam by the relay’s filter count too: several in an hour suspend the address the same way.

Blocklist monitoring

Every relay address is checked every hour against the major blocklists (Spamhaus, SpamCop, Barracuda, UCEPROTECT, PSBL, Mailspike and others). A listed address leaves the rotation at once — your mail continues from the other addresses of its pool — and comes back only after it is clean again.

Daily sending quota

Edition	Messages per server per day through the relay
Free	200
Pro	5,000
Enterprise	custom

Over the quota nothing is lost: the extra messages wait in the relay’s queue until the next day (UTC) and the panel warns you. Each mailbox also keeps its own hourly limit (200 by default), set per mailbox in the panel.

What you can do

• Keep the SPF, DKIM and DMARC records the panel shows (with PlusPanel DNS this is automatic).
• Send only to people who asked for your mail, and remove addresses that bounce.
• Watch Email → Deliverability: bounce rate, complaints and the reasons are there per domain.
• Use strong mailbox passwords: a compromised mailbox is the most common source of spam complaints.