Email and SSL through your control panel

You can issue a free SSL certificate and force HTTPS in cPanel and WHM using AutoSSL, then create mailboxes in cPanel. On a VPS you also need to publish SPF, DKIM and DMARC and make sure reverse DNS is correct, or your mail will struggle to arrive at large providers. If you are not using cPanel, use Certbot for SSL and configure your web server to redirect HTTP to HTTPS, then set the same mail DNS and reverse DNS.

This picks up from a server you can already reach over SSH. It focuses on AlmaLinux 9 and Ubuntu 24.04.

Before you start

• Control panels: on a Hostworld VPS, you manage the VPS itself in Virtualizor from the client area. Website, mail and SSL are managed in cPanel. Server-wide settings are in WHM. If a step mentions Virtualizor, it is for VPS-level tasks such as possible rDNS controls. If you do not see that, we can set rDNS for you.
• Domains and port 80: Let’s Encrypt’s HTTP‑01 validation requires that port 80 on your hostname is reachable from the Internet. Let’s Encrypt follows redirects, up to 10, and does not require a valid certificate on the HTTPS side. Do not block port 80 when you plan to force HTTPS.
• AutoSSL provider: on cPanel and WHM v120 and later, AutoSSL uses Let’s Encrypt. cPanel now prompts you to accept Let’s Encrypt’s Terms of Service before it will install certificates for new domains. You will not get an automatic certificate until you have accepted those terms.
• Mail deliverability: large providers such as Gmail and Yahoo expect SPF, DKIM and DMARC, plus a valid PTR record on the sending IP that matches a hostname which forward resolves to the same IP.
• DNS authority: changes to MX, SPF, DKIM and DMARC only work when made on the authoritative nameservers for your domain. Confirm which nameservers your domain is using before you change anything.
• Email routing: if your mailboxes live on your VPS, set Email Routing to Local in cPanel and point MX at your VPS. If you use an external service, set Email Routing to Remote and point MX at that service. Mixing these causes bounces or mail going to the wrong place.
• Ports to allow: for this work you need ports 80 and 443 for web and ACME, 25 for server to server SMTP, 465 and 587 for authenticated submission, and 993 for IMAP over TLS. Cleartext submission is deprecated by RFC 8314. Make sure your firewall and any cloud rules allow these.
• Conflicting redirects: use cPanel’s Force HTTPS Redirect before adding your own .htaccess or server-level redirects. Layering redirects from multiple places can create loops or break apps.

Step 1: Pick your route

If your VPS runs cPanel and WHM, use AutoSSL for certificates, the Domains page to force HTTPS, and cPanel’s Email pages for mailboxes and deliverability records. This is the route we explain first.

If you do not have cPanel, you can obtain certificates with Certbot and force HTTPS in Apache or NGINX. You will still need to publish SPF, DKIM and DMARC and arrange reverse DNS through your provider. We cover this in a later step.

Step 2: Issue a free SSL certificate in WHM using AutoSSL

AutoSSL handles Let’s Encrypt certificates for your cPanel accounts. It can also add a CAA record when needed before requesting a certificate. Since cPanel and WHM v120, Let’s Encrypt is the only AutoSSL provider.

1. Open WHM and accept Let’s Encrypt’s Terms of Service. WHM will prompt you to accept Let’s Encrypt’s ToS for new domains before AutoSSL can install a certificate. Do this once and it applies to future requests.
2. Enable and run AutoSSL for your account in WHM. In WHM, use Manage AutoSSL. Ensure AutoSSL is enabled for the account that owns the domain. You can start a run to request and install certificates immediately. If your DNS is hosted in cPanel for the domain, AutoSSL can add a CAA record first if needed.
3. Wait for AutoSSL to complete and verify the certificate is installed. When done, cPanel for that domain will show the certificate under its SSL interfaces and the site will answer on HTTPS.

If AutoSSL does not install automatically for a new domain, check that you have accepted Let’s Encrypt’s ToS and that port 80 is reachable. CAA records that disallow Let’s Encrypt will also block issuance until they are adjusted.

Step 3: Force HTTPS for your site

cPanel provides a toggle for HTTPS redirection that works cleanly for most sites and avoids conflicts with app-level rules.

1. Enable the redirect in cPanel. In cPanel, open Domains. Use the Force HTTPS Redirect toggle for the domain and any aliases you want to enforce.
2. Check why the toggle might be disabled. If the option is greyed out, common reasons include the absence of an installed certificate or related WHM Tweak Settings. Install the SSL first and then return to toggle the redirect.

If you need to create custom redirects for other reasons, cPanel’s Redirects tool notes that the Domains Force HTTPS Redirect is the preferred method for HTTPS enforcement to avoid conflicts.

Step 4: Create mailboxes in cPanel

Mailboxes live in your cPanel account. You create them in Email Accounts and get the exact connection settings from there.

1. Create the mailbox. In cPanel, go to Email, then Email Accounts. Add the address, set a password and set a storage limit if you want one.
2. Get connection settings. In Email Accounts, use Set Up Mail Client for that mailbox. cPanel shows the exact IMAP, POP and SMTP server hostnames and ports, including the SSL settings. For secure submission and retrieval, you will use ports such as 465 or 587 for SMTP submission and 993 for IMAP over TLS.

Step 5: Set Email Routing and MX records to match where mail lives

This step decides where incoming mail is delivered and prevents misrouting.

1. Decide where the mailbox will live. If the mailboxes are on your VPS, you are hosting mail locally. If the mailboxes are on a service like Microsoft 365 or Google Workspace, you are hosting mail remotely.
2. Set Email Routing accordingly in cPanel. In cPanel, open Email Routing. Choose Local if you host mail on the VPS. Choose Remote if you host mail elsewhere.
3. Point the MX record to the right place. If you host mail locally, set the MX record to your VPS hostname or mail hostname. If you host mail remotely, set MX to the values given by that service. Make these changes on the authoritative nameservers for your domain. Changing records on the wrong DNS platform has no effect.

Incorrect routing causes bounces or mail being delivered to the wrong server. Verify both the Email Routing setting and the MX record before changing live services.

Step 6: Publish SPF, DKIM and DMARC

These records authenticate your mail and are required by major providers.

1. Open the Email Deliverability tool. In cPanel, use Email Deliverability. It diagnoses and helps you install SPF and DKIM for each domain on the server if the DNS zone is hosted there. If you host DNS elsewhere, copy the suggested records from Email Deliverability and publish them at your external DNS provider.
2. Add DMARC. You can add DMARC via the Zone Editor or the DMARC helper. cPanel’s documentation shows how to build a DMARC record for your policy. Start with a monitoring-only policy if you are unsure, then tighten it when you are ready.
3. Check what large providers expect. Gmail’s 2024 sender requirements call for valid SPF, DKIM and DMARC and a correct PTR record. Yahoo sets similar requirements, especially for bulk senders. Plan these before sending real mail.

All DNS changes must be made on the authoritative nameservers for your domain. If your domain does not use DNS hosted on your VPS, you will not see the changes until you publish them at your registrar’s DNS or wherever your zone is hosted.

Step 7: Configure reverse DNS (PTR) for your VPS

Reverse DNS maps your sending IP to a hostname. Mail providers check it. The PTR record should map the sending IP to a hostname that forward resolves to the same IP. cPanel advises aligning the rDNS of Exim’s sending IP to the server hostname.

1. Decide the hostname you want the PTR to return. Use the server’s hostname or a mail-specific hostname that already forward resolves to the sending IP.
2. Set the PTR with the IP owner. PTR is set by the organisation that controls the IP’s reverse zone. On a Hostworld VPS, check Virtualizor. We can expose rDNS management there. If you do not see an rDNS option, open a support ticket and tell us the IP and the exact hostname you want for the PTR.
3. Verify forward and reverse match. After the PTR is set, confirm that the hostname resolves to the same IP and that the IP’s PTR returns that hostname. This alignment reduces spam filtering.

Step 8: Not using cPanel? Issue SSL with Certbot and force HTTPS

If you run Apache or NGINX without cPanel, use Certbot from the snap package. Use the Apache or NGINX plugin on a production server. Avoid the standalone plugin unless you can stop the web server, because it needs to bind to ports 80 or 443 during validation.

Install Certbot via snap

This installs the maintained snap build of Certbot. Remove any OS-packaged Certbot first to avoid conflicts.

Ubuntu 24.04

Install the Certbot snap. This downloads and prepares Certbot on your system.

sudo snap install --classic certbot

AlmaLinux 9

Install snapd from the AlmaLinux repositories, then install the Certbot snap. AlmaLinux’s wiki covers enabling the repositories and installing snapd. After snapd is installed and running, run:

sudo snap install --classic certbot

Request a certificate with an Apache or NGINX plugin

These commands ask Certbot to obtain and install a Let’s Encrypt certificate using your web server’s integration. They prompt for the domains and can add an HTTPS redirect for you. Replace the example domains with your real domain names.

# NGINX installer and authenticator
sudo certbot --nginx -d example.com -d www.example.com

# Apache installer and authenticator
sudo certbot --apache -d example.com -d www.example.com

If you cannot use a server plugin, use a webroot authentication method. Avoid the standalone plugin on a live site unless you can stop your web server because the standalone plugin needs to bind to port 80 or 443.

Force HTTP to HTTPS at the web server

If your installer did not add a redirect, configure one at the server level.

For NGINX, return a permanent redirect from a port 80 server block. This returns a status 301 to the same host on HTTPS and preserves the request path.

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

For Apache, add a Redirect in a dedicated port 80 VirtualHost. This tells Apache to issue a 301 redirect to HTTPS for all requests.

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    Redirect "/" "https://example.com/"
</VirtualHost>

Let’s Encrypt’s HTTP‑01 validation follows redirects and does not require a valid certificate at the HTTPS target. You must keep port 80 reachable while requesting or renewing certificates.

What next

• Test sending and receiving. Send to real external inboxes, including Gmail and Yahoo, and inspect the headers for SPF, DKIM and DMARC passes. If you see rejections tied to PTR or authentication, adjust the records and retest.
• If you are planning a VPS and want full control with cPanel, see our UK range at Linux VPS.
• Browse more material in our VPS guides. If you get stuck on reverse DNS or DNS records and want us to take a look, open a support ticket.

Next step: monitor delivery and troubleshoot rejections. Check bounces, look at Email Deliverability in cPanel or WHM, and adjust policies as you move from monitoring to enforcement on DMARC.