In 2024, Prachyam Studios needed to send a lot of email. Not newsletter-scale email — marketing at genuine scale, to a user base that cared about the content. The budget for this was approximately nothing, because Prachyam was a volunteer-run operation and "spend ₹4L/month on a managed email service" was not an option.
So I built it from scratch. Postfix, Dovecot, DKIM, SPF, DMARC, Rspamd, 6 servers, 12 domains, IP warmup from zero. Over the next year we sent roughly 20 million emails. The deliverability held up. The cost was a few thousand rupees a month in VPS bills.
This is everything I learned, including the things I wish someone had told me before I started.
Why Not Managed?
The managed email services — AWS SES, SendGrid, Postmark, Mailgun — are genuinely good products. I've used all of them. If you have the budget and don't want to learn the internals, they're the right choice.
For Prachyam, they weren't viable for two reasons.
Cost. At the volumes we needed, managed services price per-email in ways that add up fast. SES at $0.10/1000 emails sounds cheap until you're sending 20M emails and the bill is ₹1.7L. Multiply that by multiple campaigns per month.
Control. Deliverability is not a knob managed services expose to you. When Gmail starts deferring your emails, your options are "open a support ticket and wait" or "change your sending patterns and hope." When you own the stack, you can read the logs, adjust the retry schedule, tune the throttling per-domain, and understand exactly why a specific receiving server is rejecting you.
The second reason is the real one. I wanted to understand how email actually works, not just consume it as a service.
The Architecture
Six VPS nodes across two providers, each running a purpose-specific role:
The split between transactional mail (Node 1) and bulk marketing (Node 3) is critical. You never want your marketing IP reputation to affect your transactional mail deliverability. A single spam complaint about a newsletter should not delay a password reset email.
Each domain gets its own DKIM key. Each key is 2048-bit RSA. The keys live in /etc/opendkim/keys/ on the outbound relay with permissions restricted to the opendkim user.
The DNS Stack
For each domain, you need six types of records. I wrote a generation script that outputs them all given a domain name:
The PTR record (reverse DNS) is the most commonly forgotten. It maps your IP address back to a hostname. Most hosting providers let you set it in their VPS control panel. Without a PTR record, many receiving servers will reject or heavily score your mail.
IP Warmup: The Part Nobody Does Right
A fresh IP address has no reputation — which is treated as a bad reputation by large receiving servers. Gmail, Yahoo, Microsoft 365 all throttle or reject high-volume sending from unknown IPs.