Your PowerMTA,
configured right.

For years, a sloppy sending setup mostly cost you the spam folder. That has changed. Gmail, Yahoo and Microsoft now set explicit conditions for sending to their users, and over 2024 and 2025 they moved from advisory guidance to active enforcement. Mail that fails the bar increasingly does not get filtered — it gets refused at the door.

The conditions themselves are clear. Any domain sending a meaningful volume to consumer Gmail, Yahoo or Outlook addresses is expected to authenticate with SPF, DKIM and a DMARC policy that passes alignment, keep its spam-complaint rate under 0.3% (and ideally below 0.1%), publish valid reverse DNS, encrypt the connection with TLS, and offer one-click unsubscribe on marketing mail with opt-outs honored within a couple of days. Even senders below the bulk threshold are now expected to authenticate and present valid reverse DNS and TLS.

The teeth came later. Gmail shifted from temporary deferrals to permanent rejections for persistently non-compliant senders in late 2025, and Microsoft began rejecting non-compliant bulk mail to Outlook, Hotmail and Live addresses outright. A setup that would have squeaked by in 2023 now bounces. That is the entire reason autopmta exists: every one of those conditions — authentication, reverse DNS, TLS, reputation hygiene — is something the Configurator sets up and verifies before your server sends its first message, so you start compliant instead of discovering the gaps in your bounce logs.

There's a second half to staying compliant that no install handles for you: keeping the list to people who want it. One-click unsubscribe has to be honored within a couple of days, and a spam-complaint rate creeping toward 0.3% will sink a domain no matter how clean its authentication is. The setup gives you the tools — feedback-loop processing and suppression that act on complaints before the next send — but the discipline of mailing only engaged, opt-in recipients is yours to keep. If you're new to how complaints feed reputation, the feedback loop guide is the place to start.

Start with a clean AlmaLinux, Rocky, Debian, Fedora or Ubuntu box and your engine in hand — a licensed PowerMTA, or KumoMTA. The first phase installs and configures the whole stack — the engine itself, plus Postfix and Dovecot for inbound and mailbox handling, Nginx, Node.js for the dashboards, and the CSF firewall — so you're not assembling pieces by hand or chasing a missing dependency at 2am.

The second phase is where most manual setups go wrong, and where the automation earns its keep. For every domain you're sending from, it generates a 2048-bit DKIM key, an SPF record scoped to your actual sending IPs, a DMARC policy at p=reject with reporting addresses, an MTA-STS policy, TLS reporting, and the IPv4 and IPv6 reverse-DNS records — then publishes all of it through the Cloudflare API rather than leaving you to paste records into a dashboard one at a time. The third phase does something a hand-build almost never bothers with: it waits, and verifies. Nothing moves forward until each record has actually propagated and resolves correctly, so you never bring a server online with half its authentication missing.

Only then does the final phase apply the production configuration — the dual-stack virtual MTAs and IP pools, the authenticated SMTP listeners, Let's Encrypt certificates, the MailWizz wiring, and the per-client dashboard. By the end you have a server that signs its mail, routes Gmail over IPv6 with IPv4 as the fallback, reports on itself in real time, and has every authentication check already passing. The typical run finishes inside an hour, and because the configuration is generated from your domains file rather than typed, the next server you build comes out identical.

The installer demo at the top of this page mirrors that sequence: type a domain, and it walks through the same phases it would run for real — DKIM and DMARC generated for that domain, DNS published, dual-stack VMTAs and routing brought up, the server reported live. It's a simulation rather than a live deploy, but the order and the records are the real ones, so you can see exactly what the Configurator does before you run it on a box of your own.

Search for a PowerMTA installer and you'll quickly find tools and sellers offering the engine "without a license", a "shared" license, or paired with promises of "unlimited" sending. We don't, and the reason is practical as much as principled. Cracked or shared software is a legal and operational liability, it can't be updated or supported properly, and it almost always travels with the kind of sending — bought lists, unsolicited bulk, filter evasion — that gets IP ranges blocked within weeks. You'd be building on sand.

autopmta takes the opposite stance on purpose. You run a legitimate engine — either a properly licensed PowerMTA, or KumoMTA, which is open-source and free — and the Configurator installs and configures it and automates the legitimate, permission-based sending around it. That constraint is a feature: a setup designed for senders who want to be in the inbox for years looks completely different from one designed to blast a list once and rebuild after the block. Everything here — real authentication, isolated reputations, honest warm-up, throttling that respects each provider's limits — is built for the first kind of sender.

If you'd rather not buy a license at all, KumoMTA is supported directly and costs nothing to run; the PowerMTA pricing & license guide explains the PowerMTA side, and the alternatives roundup covers the wider open-source and commercial options.

And if you already run a licensed PowerMTA but inherited a setup you're not sure about, that's a common starting point too. A configuration built in a hurry, or by someone who has since left, tends to hide exactly the gaps that cost placement — a missing reverse-DNS entry here, an SPF record over its lookup limit there. Rebuilding it on a verified, reproducible configuration turns an opaque box only one person understood into something you can read, audit and stand up again on demand.