Deliverability
Software is the easy half. Whether mail arrives depends on DNS and IP reputation, and skipping this is the usual reason self-hosted mail lands in a spam folder. None of it is Sentio-specific, and all of it is required.
DNS You Must Publish
For mail.example.com serving example.com:
| Record | Example | Why |
|---|---|---|
A / AAAA | mail.example.com → 203.0.113.10 | Reachability |
MX | example.com → 10 mail.example.com | Where inbound mail goes |
PTR | 203.0.113.10 → mail.example.com | Reverse DNS. Set by your hosting provider, not your DNS host. |
SPF | v=spf1 mx -all | Which hosts may send for the domain |
DKIM | from /v1/domains/{id}/dns-records | Signature verification |
DMARC | v=DMARC1; p=quarantine; rua=mailto:... | Alignment policy and reports |
Sentio generates the SPF, DKIM and DMARC records, and POST /v1/domains/{id}/verify checks what has actually propagated rather than what you intended.
The Two That Catch People Out
Outbound port 25 is blocked by default on most residential ISPs and by several cloud providers, AWS, GCP, Azure, Oracle and Hetzner among them. You may need to request a limit lift, or relay through a smart host with [delivery.relay]. Nothing in your configuration will tell you this is the problem; mail simply will not leave.
Forward and reverse DNS must agree. Many receivers reject mail from a host whose PTR does not resolve back to its address. Only your hosting provider can set PTR, so this is a support ticket rather than a config change, and it is worth raising before you need it.
IP Pools And Warmup
A new IP address has no reputation, and sending it straight to full volume is how it acquires a bad one. Assign tenants to dedicated or shared pools, and ramp a new address on a schedule with per-ISP overrides.
Tenant tiers decide the isolation: dedicated gets its own pool, the shared tiers do not. Anyone whose volume justifies a dedicated pool should have a warmup schedule rather than day-one volume.
Suppressions
Hard bounces and ISP complaint reports (FBL/ARF) suppress addresses automatically, and one-click unsubscribe is honoured. Suppression lists are per tenant, so one customer's bad list does not shape another's sending.
Continuing to send to addresses that bounce is one of the fastest ways to lose a reputation, which is why GET /v1/suppressions exists: check before you spend a send.
Reports Instead Of Guesswork
DMARC aggregate, FBL/ARF and TLS-RPT reports are ingested and readable over the API. That matters because the alternative is inference: without them, an authentication failure or a TLS problem shows up only as mail quietly not arriving, and you are left guessing which of a dozen things changed.
Transport Security
Sentio implements STARTTLS, MTA-STS, DANE and TLS-RPT. MTA-STS and DANE are how a sender learns that your server is supposed to offer TLS, which is what stops an attacker stripping it. TLS-RPT is how you find out when someone could not negotiate it.
Queue Control
Inspect queue depth, list deferred mail, and pause or resume delivery without stopping the server. Pausing is the right first move when you discover something is sending mail it should not: stop the queue, then work out why.