A proxy on your own VPS with a clean address history
Any server of yours with an external address can become a proxy: the Hub adds its addresses to the fleet, installs an exit service and lets only your sending servers through it.
Entry and exit are the same address: you order its reverse DNS record under your own domain name, and you know the address’s history from day one.
01 / Your own server as a proxy
Your VPS with an external address becomes your own proxy server: the Hub installs an exit service on it and lets only your sending servers through. The address the gate connects to and the address the mailbox provider sees are one and the same.
The Hub adds the server’s addresses to the fleet, installs the exit service and lets in only your sending servers
The exit service on vds-01 lets in only mta-01 and mta-02 — the servers of the pools where its addresses work. There’s no password: access is granted by your servers’ addresses.
Entry and exit are the same address, so you order the reverse DNS record from the hosting provider under your own domain name. It matches the forward record, and mail servers see that.
02 / Own or rented
Your own address gives you what a rental doesn’t come with: your own reverse DNS, a clean history, and the certainty that no stranger is sending mail from the same address. The price is renting the server and looking after it.
On your own — yours, and FCrDNS matches. On a rented one — someone else’s, and Microsoft and Yahoo can see that.
Your own address is clean from day one. Anyone could have sent anything from a rented one before you.
Your own address — nobody. A free one — anyone, at the same time as you.
Your own proxy lets in connections from your servers’ addresses. A rented one uses a login and password in clear text.
On your own it’s checked when the address is accepted; on a rented one it’s usually closed.
Your own — server rent plus upkeep. A rented one is cheaper, with nothing to install.
03 / Make a proxy
The page suggests servers with an external address that aren’t busy with other work yet. The “Make a proxy” button adds their working IPv4 addresses to the fleet and installs the exit service — no need to log in to the server and set up the proxy by hand.
vds-02 — 203.0.113.171, two working IPv4 addresses. “Make a proxy” adds them to the fleet as own proxies on port 1080 and installs the exit service.
A server for proxies is connected in the “Nodes” section with the “Own proxy” role — no MTA is installed on it. If there are no free servers, the page names what keeps the rest busy.
04 / Server vds-01
For each server you see what’s installed on it, who the service lets in and what the checks of its addresses found. “Blacklists not asked yet” is an answer of its own, not “clean”.
Port 25 is open on all three addresses, reverse DNS is your own and matches the forward record, and the blacklists are clean. The last check was on Oct 21 at 11:00.
px-10 works in “Sending · marketing”, px-11 in “Ramping up new addresses”, both with their own subdomain. px-12 waits in the marketing reserve.
The addresses of one server are usually in one subnet — mailbox providers see them as one source: the reputation is shared, and blocking one drags down the rest.
05 / The interface in detail
All the screens of the own proxy servers section: the idea of the page, how they differ from rented ones, free servers, and the card of a server running the exit service. Above each screenshot: why the screen matters. Below it: what it shows.
The page starts with the idea: your server with an external address becomes a proxy, and its entry and exit are the same. Below — six differences between your own server and a rented proxy, side by side in one table. These two screens help you decide whether to keep your own proxy servers instead of, or alongside, rented ones.
The top of the “Own proxies” page: the module tabs and a proxy count by type — 8 rented, 3 own VDS. The count shows at a glance what share of your fleet runs on your own servers. Below it — the page’s idea in one line: your server with an external address becomes a proxy, the Hub installs an exit service on it and lets in only the addresses of your sending servers. Your own proxy’s entry and exit are the same address, and all its advantages follow from that. Any server of yours with an external address can become your own proxy, and the next screen shows how it differs from a rented one.
EnlargeAny server of yours with an external address can become your own proxy.
Six differences between your own proxy server and a rented proxy — in one table: on the left, what your own address gives you; on the right, what you get with a rented one. The screen helps you decide what’s worth paying for: your own reverse DNS, a clean history from day one, no strangers on the same address, and access without a password. In return — VDS rent and upkeep, and port 25 depends on the hosting provider. The main difference isn’t the price, but who is responsible for the address’s reputation. The login and password of a rented SOCKS5 proxy travel in clear text — that’s how the protocol itself works — while your own proxy lets in connections from your servers’ addresses, with no password.
EnlargeThe login and password of a rented SOCKS5 proxy travel in clear text — that’s how the protocol itself works.
Next — the servers themselves. First the free ones, which you can turn into proxies with the single “Make a proxy” button. Then the ones already working: with the exit service, the list of allowed servers, address checks and where each address sits in the pools.
A list of servers where you can set up your own proxy: they have an external address and aren’t busy with other work yet. In the example it’s vds-02 — 203.0.113.171, two working IPv4 addresses. The “Make a proxy” button adds both addresses to the fleet as own proxies on port 1080 and installs the exit service; the “Configure” link leads to the server’s card. If there are no free servers, the page names what keeps the rest busy; a new server for proxies is connected in “Nodes” with the “Own proxy” role. No MTA is installed on such a server. After “Make a proxy”, its addresses work in pools on a par with rented ones.
EnlargeIf there are no free servers, the page names what keeps the rest busy: a gate, their own sending, no external address, a server not in service.
The card of the working proxy server vds-01: its address, OS, exit service version and how long it’s been running. Below — who the service lets in (only mta-01 and mta-02), four checks and the table of the server’s addresses. This is where you see whether the addresses are fit for mail: port 25 is open on 3 of 3, reverse DNS is your own on 3 of 3, the blacklists are clean. The “Check” and “Reinstall the daemon” buttons poll the server again or put a fresh service file in place. At the bottom is a warning about the shared reputation of one server’s addresses. Mailbox providers see the addresses of one server as one source, so blocking one drags down the rest.
EnlargeThe addresses of one server are usually in one subnet: mailbox providers see them as one source, and blocking one drags down the rest.
06 / Questions about own proxies
In short: how a server becomes a proxy, who it lets in, and why it’s worth spreading out the addresses of one server.
EnlargeWho the service lets in, checks across all the server’s addresses, and where each address works.
A server of yours with an external address on which the Hub has installed the exit service. Its addresses work in pools just like rented ones, and their entry and exit are the same.
Your own reverse DNS, a clean history, and no strangers on the same address. You don’t get that with a rental.
No. The exit service lets in only the addresses of your sending servers — the ones where this server’s addresses work.
No. A server for proxies is connected in “Nodes” with the “Own proxy” role, and no MTA is installed on it.
It puts a fresh exit service file in place and rewrites the list of allowed addresses.
The first check happens at the scheduled recheck, after that — on the schedule set on the “Checks” page. Port 25 on your own server depends on the hosting provider.
They’re usually in one subnet, and mailbox providers see them as one source. The reputation is shared, and blocking one address drags down the rest.
Each allowed address shows which of your servers in the Hub it belongs to. An address that belongs to no server is marked: the list may be out of date.
07 / Next step
Your own proxies are the most reliable addresses in the fleet, but also the most expensive. The Hub collects free addresses from public lists, and their sources are set up separately.
Where your own servers’ addresses work is set in pools, and the whole route — from the MTA through the gate to the recipient — is shown in the module overview.
