# How to Setup Coolify SMTP Relay & Bypass Port 25 Blocks

_By Tayyab Mughal, Founder & Chief Architect · 06 November 2026 · 4 min read_

> Step-by-step guide to configuring authenticated SMTP relay in Coolify. Unblock outbound email on Hetzner, OVH, and cloud VPS with port 587 STARTTLS.

A complete DevOps tutorial on configuring authenticated SMTP relay in Coolify, bypassing outbound port 25 blocks on Hetzner, and ensuring 100% deliverability.

## Why self-hosted Coolify instances fail to deliver transactional email

Coolify has transformed how developers deploy self-hosted applications, databases, and microservices on private virtual servers. However, almost every developer encountering Coolify for the first time runs into the same frustrating barrier: transactional emails, password resets, and deployment alerts never arrive in recipient inboxes.

The cause is rarely a bug in Coolify or your Docker container. Instead, cloud VPS providers like Hetzner Cloud, DigitalOcean, OVHcloud, and Scaleway actively block or filter outbound TCP traffic on port 25 across all newly provisioned virtual machines. Because port 25 was traditionally used for unauthenticated server-to-server mail routing, cloud hosts shut it down to prevent compromised instances from spewing botnet spam.

To send reliable notifications, user invitation emails, and password reset links from your Coolify stack, you must route your outbound email through an authenticated SMTP relay operating on port 587 with STARTTLS encryption.

## 1. Why VPS providers block port 25 and reject unblock requests

Hetzner Cloud enforces an automatic port 25 firewall rule on every new project. While Hetzner permits customers to submit a support ticket requesting port 25 unblocking, their compliance team typically requires a minimum of one month of verified billing history, government ID submission, and a documented technical justification. Even then, requests are frequently denied.

DigitalOcean took this policy further in June 2022 by permanently blocking port 25 on all new Droplets, with zero exceptions granted by their support team.

Even if your hosting provider unblocks port 25, sending mail directly from a VPS IP range is hazardous. VPS IP blocks are frequently listed on public anti-spam databases because previous tenants may have abused them. Without verified reverse DNS (PTR records), strict SPF alignment, and Dual-DKIM signing, major inbox providers like Gmail, Yahoo, and Microsoft 365 will silently drop your messages into the spam folder.

## 2. Configuring Coolify transactional email settings with SadaSend

Configuring authenticated SMTP relay in Coolify takes less than two minutes and bypasses cloud firewall restrictions completely.

First, open your Coolify web dashboard and click on Settings in the left sidebar. Under Server Settings, locate the Transactional Email tab and toggle Enable Transactional Email to ON.

Enter the following connection parameters:

• SMTP Host: smtp.sadasend.com
• SMTP Port: 587
• Security: STARTTLS (or TLS)
• SMTP Username: apikey
• SMTP Password: Your SadaSend production API key (generated in your dashboard)
• From Address: notifications@yourdomain.com
• From Name: Your Coolify Production Server

Once configured, click Send Test Email. Coolify will connect to SadaSend over port 587, authenticate securely, and dispatch a test message to your inbox in sub-150ms.

## 3. Passing SMTP credentials to Docker containers and Nixpacks

While the Coolify server-level settings handle system alerts and user invitations, individual applications deployed within Coolify (such as Laravel, Ghost, Nextcloud, or Node.js services) require their own environment variables.

In your application settings in Coolify, navigate to Environment Variables and add the standard SMTP block. Here is a production-ready example compatible with most modern frameworks:

```bash
# Application Environment Variables (.env) in Coolify
MAIL_MAILER=smtp
MAIL_HOST=smtp.sadasend.com
MAIL_PORT=587
MAIL_USERNAME=apikey
MAIL_PASSWORD=sada_live_your_production_key_here
MAIL_ENCRYPTION=tls
MAIL_FROM_ADDRESS=support@yourdomain.com
MAIL_FROM_NAME="Production Application"
```

## 4. Protecting your sender reputation with pre-send bounce defense

When running public web services on Coolify, bots and malicious users often submit fake or disposable email addresses into registration forms. If your self-hosted server sends confirmation messages to these non-existent inboxes, your domain bounce rate will quickly exceed the critical 2.0% threshold enforced by Gmail and Yahoo.

SadaSend shields your domain automatically with an in-flight Pre-Send Bounce Shield. Before any message leaves the queue, SadaSend checks recipient address syntax, queries destination MX records, and detects burner domains, keeping your bounce rate at 0% and your inbox placement flawless.

---

_Tags: Coolify, SMTP, Self-Hosted, DevOps, Hetzner, Port 25_