Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want be able to send outgoing email from my website. I want to setup Win2008 smtp to be able to send them respecting all the spam rules.

My checklist is:

  • the smtp should be able to accept outgoing email only from internal sites: I will limit it to relay only is this correct?
  • it should have set SPF, DKIM and all the policy avaiable to not be marked as spam: how you would configure it for the internal SMTP? Should I use another kind of server like hMail server?
  • I should be able to send like 30 email from each user session on the website without obliging the user to wait that the email is effectivly sent (I thought to save it on a folder and then use a batch to send them asynchronously). What are my options?

What other steps would you add to be sure that the outgoing email is not marked as spam?

share|improve this question
up vote 1 down vote accepted

Yes set it to only relay mail from the local host. SPF and DKIM - both of these are handled in DNS... with the addition of the mail sending app signing the emails with the domain key. IIS does not do this natively - you'd have to use a third party app such as If you want something that does it native you'd need to just go with a third party app. Two more things - make sure that you have a fully qualified host name (externally) for your mail server and a reverse (PTR) record in DNS for it. Lastly you may want to read up on back scatter and decide how/if you want to deal with it:

share|improve this answer

In order of checklist: I don't think you need to enable relay at all (unless that is how it is by default). IIS web apps usually pass email to the SMTP server via a different method then "connect localhost:25". I would test and see if it works without relay allowed. Ultimatly this is a programming question. Dave Holland is correct on #2. Your last checklist question is better served by

Other items: don't let users control the From:. You always want the from to be a domain you control that the server is setup in SPF for.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.