Huawei Cloud Global Edition Huawei Cloud email server configuration
Huawei Cloud Global Edition Introduction: The “Why is my email in spam?” Survival Guide
Configuring an email server is one of those tasks that looks deceptively simple on paper. You imagine a neat little checkbox here, a few settings there, and voilà—emails fly out into the world like doves wearing tiny delivery uniforms. Reality tends to include a whole circus: DNS delays, authentication records that were “almost” correct, firewall rules that were “mostly” open, and security settings that say “deny” in a voice so calm it’s basically smug.
This article is your friendly field manual for configuring an email server on Huawei Cloud. We’ll focus on a practical, step-by-step approach: choosing the right building blocks, setting DNS, enabling SMTP/IMAP, configuring authentication (SPF/DKIM/DMARC), tightening security, and then monitoring and troubleshooting like a professional who has seen this movie before.
Note: Huawei Cloud offers multiple services related to email and communications (including dedicated email solutions, SMTP relays, and infrastructure components). The exact console labels may vary depending on your region and service selection. But the core concepts remain the same: mail delivery depends on correct DNS, correct credentials, correct ports, and correct security policy. The rest is just UI layout and coffee.
Before You Touch Anything: Clarify Your Email Mission
Let’s start with a small but powerful question: what are you trying to do?
Common scenarios
- Transactional email: password resets, order confirmations, alerts. Usually higher priority for deliverability.
- Marketing email: newsletters, promotions. Requires careful reputation management and compliance.
- Internal company mail: employees communicating with each other on your own domain.
- Email receiving and sending: both inbound and outbound, often involving IMAP/POP settings.
Decide your “deliverability priority”
Deliverability is basically the internet’s way of asking, “Who are you, and are you legit?” The higher the importance of your emails landing in inboxes, the more seriously you should take SPF, DKIM, DMARC, and rate/abuse controls.
Choosing the Right Huawei Cloud Setup
When people say “email server,” they sometimes mean different things. Let’s map typical choices in a way that won’t make your brain trip over itself.
Option A: Use a managed email service
If Huawei Cloud provides a managed email solution in your environment, that’s often the least painful route. Managed services handle many operational tasks: server maintenance, TLS/cert setup patterns, and sometimes automatic integration with DNS verification.
Pros: faster setup, fewer moving parts.
Cons: less low-level control, depending on the service.
Option B: Build an infrastructure-based mail flow
If you want a mail server on compute infrastructure (for example, with your own SMTP/IMAP configuration), you’ll assemble the pieces: compute instances, network security, and mail software. This offers flexibility but demands careful configuration and ongoing maintenance.
Pros: full control, customizable policies.
Cons: you own the operational burden (and the debugging).
Option C: Relay outbound via an SMTP relay service
Some teams don’t need inbound at the server level—they just need reliable sending. In that case, using an SMTP relay is like using a professional shipping service rather than trying to throw your packages into the ocean and hope for the best.
Pros: simpler, often better deliverability controls.
Cons: inbound handling still requires your chosen receiving strategy.
Domain Preparation: The Unsexy Part That Makes or Breaks Everything
Even if your server configuration is perfect, email delivery will still fail if DNS records don’t match your server identity. Think of DNS as the identity card for your domain. If it’s wrong, the internet politely denies entry.
What you need for DNS
- A/AAAA records (if you’re hosting inbound yourself): map your mail hostname to IP addresses.
- MX record: points your domain’s mail to the correct mail exchanger.
- SPF record: authorizes which servers can send mail for your domain.
- DKIM record: cryptographically signs emails so receivers can verify authenticity.
- DMARC record: instructs receivers what to do if SPF/DKIM fail (and provides reporting).
- PTR / Reverse DNS: often required for good deliverability (depends on how your hosting provider sets it).
Pick a mail subdomain
Using a dedicated subdomain like mail.yourdomain.com (instead of only your root domain) can keep things organized and reduce confusion. Many administrators love organization almost as much as they love arguing over tabs vs spaces.
Set Up DNS Records (SPF, DKIM, DMARC, MX)
Let’s make this practical. Below is the structure you should aim for. Exact values depend on your service and server IPs, but the patterns are stable.
MX record: where incoming mail goes
Your MX record generally looks like:
yourdomain.com MX 10 mail.yourdomain.com
Replace with your actual mail hostname and priority. If you’re using multiple MX records, priorities matter (lower value = higher priority).
SPF record: who is allowed to send
A typical SPF record might be:
yourdomain.com TXT "v=spf1 a mx ip4:YOUR_SENDING_IP -all"
But please don’t copy-paste blindly. SPF must match your actual sending infrastructure. If you’re using an SMTP relay, include the relay’s authorized mechanism. If you have multiple sending services, SPF may need include directives.
Common mistake: setting SPF too strictly and accidentally blocking legitimate senders (including your own server).
Huawei Cloud Global Edition DKIM record: proving you’re you
DKIM uses a selector (for example, selector1) and publishes a public key in DNS. The record often looks like:
selector1._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=PUBLIC_KEY"
The private key lives on your mail server (or signing service). Your server will sign outgoing emails with the private key, and receivers verify it using your public key from DNS.
Common mistake: mismatching the selector your server uses vs the selector in DNS.
DMARC record: what happens when things fail
A typical DMARC policy starts cautiously:
_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; adkim=s; aspf=s"
Once you confirm alignment in reports, you can move toward p=quarantine or p=reject. DMARC is not a “set it and forget it” toy. It’s more like a thermostat—you should check it after installation.
Huawei Cloud Global Edition Network and Firewall: Don’t Let Your Mail Get Lost in the Parking Lot
When people configure an email server, they often open outbound and forget inbound. Or they open inbound but forget the specific ports. Or they open the ports but forget security group association. Basically, it’s a sitcom where every episode is a new twist.
Ports you’ll likely need
- SMTP: 25 (server-to-server), 587 (submission), 465 (SMTPS, depending on config)
- IMAP: 143 (plain), 993 (IMAPS)
- POP3: 110 (plain), 995 (POP3S)
- DNS (for server operations): 53 (outbound to resolver), NTP (123), etc.
Only expose what you need. If you don’t provide POP, don’t open POP. Reducing your attack surface is like wearing shoes that are slightly less likely to get stolen.
Security groups and inbound rules
In Huawei Cloud, you’ll typically define security rules in a security group associated with your compute instance. Make sure inbound rules allow traffic only from required sources (for example, allow 25 from the internet for receiving; for submission 587, you may restrict or require authentication).
For outbound, ensure your server can reach DNS resolvers and external mail networks. Outbound restrictions can cause weird symptoms like “messages stuck in queue,” and nobody likes queue limbo.
TLS Certificates: HTTPS Energy for Email Security
Email should be encrypted in transit. At minimum, enable STARTTLS for SMTP submission and server-to-client access. Many clients also expect valid certificates for IMAPS and SMTPS.
Where to get certificates
You can use certificates from a public CA, or if you’re strictly internal, you might use your internal CA. Public CA is the easiest for real-world deliverability. Self-signed certs often lead to client warnings that scream “not safe, proceed carefully.”
Matching hostnames
Ensure the certificate’s subject/alternative names match your mail hostname used in DNS (for example, mail.yourdomain.com). A certificate for mail2.yourdomain.com presented as if it were for mail.yourdomain.com is like bringing the wrong ID to a club—security checks will stop you.
Setting Up SMTP and IMAP Services
Now we get to the part that feels like “email server configuration” in the everyday sense: enabling SMTP/IMAP endpoints and ensuring they work with your DNS records.
SMTP: how mail gets sent and received
You typically need two flavors:
- Inbound SMTP: receiving mail from other servers (port 25)
- Outbound SMTP submission: clients sending mail (port 587 or 465), usually requiring authentication
Make sure your SMTP service supports:
- STARTTLS (if using 25/587)
- SMTP AUTH for submission (587/465)
- Proper HELO/EHLO identity (often tied to hostname)
IMAP: receiving mail in clients
IMAP should support SSL/TLS (993). Configure user authentication and mailboxes. Also ensure the mail directory structure is correct so clients can list and download messages.
If you’re not providing IMAP, you can skip it. If you are providing it, test it early—clients will not be patient, and neither should you.
Authentication: SPF, DKIM, and DMARC in Practice
We already covered the DNS records, but let’s connect them to the server behavior so it actually works end-to-end.
Alignment matters
SPF alignment and DKIM alignment determine whether the domain used in the SPF/DKIM results matches the visible From domain. Receivers care about alignment because it reduces spoofing. Misalignment is one reason perfectly valid emails still end up in “Junk.”
How to confirm DKIM signing
After setup, send a test email to a few providers (Gmail, Microsoft, Yahoo, etc.). Then inspect message headers to confirm:
- DKIM signature exists
- Signature domain and selector match your DNS
- SPF pass occurs (if you set SPF for your sending)
- DMARC result indicates pass/fail/none
If you can’t inspect headers, at least check provider logs and error codes. “It worked on my machine” is a phrase best retired.
Deliverability Controls: Reputation Is a Real Thing
Even with correct DNS and TLS, deliverability depends on behavior. Some systems treat new sending servers like a suspicious stranger—especially if they send too many emails too quickly.
Start small
Send a limited number of test emails, then gradually increase volume if everything looks good.
Set rate limits
Configure SMTP throttling to prevent sudden bursts that resemble spam campaigns.
Enforce authentication for submission
Port 587 submission should require authenticated sessions. Anonymous submission is a magnet for abuse.
Monitor bounce handling
Correctly handle bounces and generate meaningful DSNs (delivery status notifications). Bad bounce behavior can harm your domain reputation faster than you’d think.
User Accounts and Mailboxes
Email servers don’t deliver emails to “domains” alone—they deliver to users and mailboxes. So yes, we have to create accounts.
Create mailboxes carefully
Whether you use local mailboxes or an integrated directory, ensure:
- Unique usernames (avoid weird capitalization issues)
- Correct password policies (strong passwords)
- Huawei Cloud Global Edition Quota settings (so one mailbox doesn’t fill your disks)
Disable old test accounts eventually
Huawei Cloud Global Edition Test accounts are like training wheels. Useful while learning, but they shouldn’t roll into production forever.
Monitoring and Logging: Become the Detective, Not the Victim
If something breaks, logs are your flashlight. Without logs, you’re basically turning your troubleshooting into an escape-room challenge.
What to log
- SMTP connection attempts
- Authentication failures
- Queue activity (what’s stuck and why)
- Delivery successes/failures
- TLS handshake errors
- DMARC/SPF-related checks (if you’re building custom logic)
Alert on the right signals
Set alerts for:
- Spikes in 4xx/5xx SMTP errors
- Queue length growing beyond thresholds
- Disk space utilization
- Repeated authentication failures
Testing Plan: Make Sure It Works Before Users Panic
Testing email is less like checking a checkbox and more like checking multiple locks on multiple doors.
Test checklist
- DNS propagation: verify MX/SPF/DKIM/DMARC records with a few DNS query tools
- Inbound SMTP: send an email from an external provider to your mailbox
- Outbound SMTP: send from your mailbox to an external mailbox
- IMAP login: test IMAP client connection using your mail hostname and TLS
- Authentication: verify SMTP AUTH for submission
- Header validation: check DKIM/DMARC/SPF results
Use multiple providers
Different providers interpret policies differently. What passes at one may fail at another if your settings are borderline. Send tests to a handful of popular receivers to avoid surprises.
Troubleshooting: The Most Common Problems (and Fixes)
Let’s walk through the “greatest hits” of email server troubleshooting. You’ll feel oddly seen.
Problem 1: Emails land in spam
Possible causes:
- Missing or incorrect SPF
- DKIM not signing or selector mismatch
- DMARC policy too aggressive early
- Reputation issues (IP/domain warm-up not done)
- Reverse DNS (PTR) missing or misconfigured
Fix approach:
- Check headers for SPF/DKIM/DMARC results
- Verify DKIM signatures exist and pass
- Ensure DMARC alignment matches your visible From domain
- Confirm PTR record points to your sending IP/hostname
Problem 2: “Temporary failure in delivery” / queue stuck
Possible causes:
- Outbound firewall blocking SMTP-related connections
- Incorrect route, gateway, or DNS resolution
- Wrong SMTP hostnames or missing credentials
- TLS handshake errors
Fix approach:
- Check server connectivity and DNS resolution
- Review SMTP logs for exact error codes
- Confirm certificates chain and TLS configuration
Problem 3: IMAP clients can’t log in
Possible causes:
- IMAP service not listening on expected port
- TLS certificate mismatch
- Firewall blocking 993
- Wrong username format or mailbox path
Fix approach:
- Huawei Cloud Global Edition Verify listening ports and service status
- Confirm security rules allow 993 inbound
- Test with a basic IMAP client and check error details
Problem 4: DKIM works in theory, fails in reality
Possible causes:
- Huawei Cloud Global Edition Selector mismatch (server signs with selector A, DNS has selector B)
- Key mismatch (wrong public key in DNS)
- Canonicalization mismatch (less common but possible)
- Mail rewriting by intermediate relay breaks signatures
Fix approach:
- Compare DKIM header fields with DNS selector
- Ensure the private/public key pair matches
- Minimize message rewriting in transit, or ensure signing occurs after rewrites
Security Best Practices: Because Attackers Also Read Documentation
Email servers are high-value targets. Not because you’re doing something wrong, but because attackers love easy targets and love guessing weak configurations even more.
Harden authentication
- Use strong passwords and disable old accounts
- Enable fail2ban-like behavior or rate limiting (if your setup supports it)
- Limit login attempts per IP
Limit what you expose
Only open inbound ports you actually need. Prefer:
- 587 with auth for client submission
- 25 carefully for inbound server communication
- 993 for IMAP (encrypted)
Huawei Cloud Global Edition Keep software updated
Huawei Cloud Global Edition Security updates for mail software matter. Outdated versions can lead to vulnerabilities that turn your inbox into an attacker’s personal playground. Patch management should be a routine, not an emergency.
Production Readiness: Your “Go Live” Checklist
Before you announce to the world that your email server is live, verify the essentials. Here’s a practical list.
Go-live criteria
- DNS records validated (MX, SPF, DKIM, DMARC)
- TLS certificate valid and matching hostnames
- Inbound and outbound mail successfully tested
- IMAP/SMTP AUTH verified (if you support those)
- No major firewall or routing issues
- Monitoring and logs enabled with alerts
- Test emails confirmed to land in inboxes (or at least not consistently in spam)
If all criteria are met, you’re ready. If not, your best friend is not optimism—it’s the checklist.
Frequently Asked Questions
Do I need both IMAP and POP3?
Not always. IMAP is generally preferred. If you don’t need POP3, skip it to reduce risk and complexity.
How long does DNS propagation take?
It can vary. SPF/DKIM/DMARC and MX changes sometimes appear quickly, but TTL settings and resolver caching affect timing. Expect from minutes to longer delays, depending on the records and resolvers.
Can I use DMARC with “p=none” at first?
Yes. Starting with p=none is a common approach because it lets you observe behavior via reports without aggressively rejecting messages.
What if my SPF record is too long?
SPF has limits on DNS lookup counts. If you use many include directives, you may need to simplify mechanisms or restructure your SPF. Consult SPF guidelines and test carefully.
Conclusion: Configure Once, Sleep Better
Configuring an email server on Huawei Cloud is absolutely doable, as long as you treat it like a system rather than a single configuration page. DNS identity (MX/SPF/DKIM/DMARC), network access (firewall and ports), secure transport (TLS), and service behavior (SMTP/IMAP correctness) all work together like a team. When one piece is off, the whole performance gets… dramatically worse.
Follow the steps in this article, test thoroughly, inspect headers, and monitor logs. Do that, and you’ll dramatically reduce the chance that your carefully written email turns into someone else’s “What even is this?” folder.
And if you still hit issues? Good news: you’re not alone. Email troubleshooting is basically learning to read the internet’s clues. The internet may be dramatic, but it is rarely random.
" }