Documentation — MailGuard Setup Guides

Setup guides

The steps below use real configuration values. When your account is set up, the DKIM record and credentials specific to your domain are sent to you; everything else works exactly as described here.

For outbound mail, first add the SPF and DKIM records and point your server to MailGuard as a smarthost; for inbound filtering, switch your MX record to us. You don't have to do both at once.

1. DNS records

Outbound mail needs SPF and DKIM; inbound mail needs an MX record. You don't have to apply them all at once — you can start with outbound and move to inbound later.

SPF — add to your existing record

If you already have an SPF record, don't create a new one; a domain can have only one SPF record. Add an include inside your existing record:

; ONCE
sizindomain.com.  TXT  "v=spf1 a mx ~all"

; SONRA
sizindomain.com.  TXT  "v=spf1 a mx include:spf.mailguard.com.tr ~all"

DKIM — a single CNAME

We generate the key pair; you only add the CNAME below. When the key needs to be rotated, you never have to touch your DNS again.

mailguard._domainkey.sizindomain.com.  CNAME  mailguard.sizindomain-com.dkim.mailguard.com.tr.

Why a CNAME? Copying a long TXT record by hand is error-prone and creates work every time the key is rotated. With a CNAME you add the record once and we manage the rest.

DMARC — recommendation

Once SPF and DKIM are in place, start in monitoring mode and tighten the policy once the report flow looks healthy:

_dmarc.sizindomain.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@sizindomain.com"

MX — only if you'll use inbound filtering

sizindomain.com.  MX  10  mx01.mailguard.com.tr.
sizindomain.com.  MX  20  mx02.mailguard.com.tr.

2. cPanel / WHM

The easiest way is the MailGuard cPanel/WHM plugin: it configures Exim routing in one click, tests the connection and can roll back if needed. If you prefer not to use the plugin, follow the manual steps below. Either way, MailGuard signs DKIM on your behalf.

MailGuard Plugin easiest

The plugin appears to root in WHM and to the end user in cPanel, showing their own domains' inbound/outbound stats and mail logs. Install — as root over SSH on the WHM server:

curl -sSL https://mailguard.com.tr/cpanel/install.sh | sh

Then WHM › Plugins › MailGuard:

Enter the SMTP credential (username + password) from your panel.
Test Connection — 587/TLS + AUTH is verified.
Apply — the Exim smarthost route is written; your current config is backed up automatically.
If anything goes wrong, Roll back — the previous Exim config returns in one click.

outbound relay active

Route your cPanel/WHM server's outbound mail through MailGuard — authenticated (SASL); DKIM is signed for you.

Connection settings

Relay host

relay.mailguard.com.tr

Port

587

SMTP username

smtp-1@relay.mailguard.com.tr

SMTP password

••••••••••••

Test ConnectionSaveApply (outbound relay)Roll back

842

Outbound — delivered (861 total)

217

Inbound — accepted (233 total)

Time	Dir	Domain	Recipient	Status
2026-07-25 22:08	out	acme.com.tr	info@musteri.com	sent
2026-07-25 21:54	in	acme.com.tr	destek@acme.com.tr	delivered
2026-07-25 21:39	out	ornekfirma.com	bulten@liste.net	bounced

WHM › MailGuard — connection settings, one-click Apply/Roll back, server-wide statistics and live mail logs. cPanel end users see only their own domains.

Manual setup (without the plugin)

WHM › Service Configuration › Exim Configuration Manager › Advanced Editor. Export (back up) your current configuration before making changes.

Method A — SMTP user (recommended)

Get your username + password from the SMTP Credential page in the panel. Under @AUTHSTART@:

mailguard_login:
  driver = plaintext
  public_name = LOGIN
  client_send = : KULLANICI_ADI : PAROLA

Under @TRANSPORTSTART@:

mailguard_smtp:
  driver = smtp
  port = 587
  hosts_require_auth = *
  hosts_require_tls = true

Under @ROUTERSTART@:

mailguard_smarthost:
  driver = manualroute
  domains = !+local_domains
  transport = mailguard_smtp
  route_list = * relay.mailguard.com.tr::587
  no_more

Method B — IP authorization (alternative)

On servers with a static IP you can use IP authorization instead of a password: tell us your IP address(es); the @AUTHSTART@ block and the hosts_require_auth line aren't needed, the transport uses port 25 and the route becomes relay.mailguard.com.tr::25.

DKIM note: cPanel's own DKIM signature passes through intact — we don't touch the message body. Even when the source server can't generate a signature, MailGuard signs the message on your behalf; you only need to publish our DKIM record in DNS.

3. Plesk

In Tools & Settings › Mail Server Settings › Relaying, route outbound mail through us:

Check "Use the specified outgoing SMTP server"
Server: relay.mailguard.com.tr — Port: 587
If you use IP authorization, leave authentication empty; otherwise enter the username and password

On Postfix-based Plesk installations you can apply the same setting from the command line:

postconf -e 'relayhost = [relay.mailguard.com.tr]:587'
postconf -e 'smtp_tls_security_level = encrypt'
systemctl reload postfix

4. SmarterMail

In Settings › Gateways / Outbound Gateways, define a new outbound gateway:

Address: relay.mailguard.com.tr, port 587
Check "Enable SMTP authentication" and enter your credentials (leave it off if you use IP authorization)
TLS/SSL must be set as required

5. Microsoft Exchange

Create a new Send Connector:

Type: Internet, Address space: *
"Route mail through smart hosts" → relay.mailguard.com.tr
Smart host authentication: Basic authentication over TLS (or None if you use IP authorization)
Port 587, TLS enabled

With PowerShell:

New-SendConnector -Name "MailGuard" -Internet -AddressSpaces "*" `
  -SmartHosts "relay.mailguard.com.tr" -Port 587 `
  -SmartHostAuthMechanism BasicAuthRequireTLS `
  -AuthenticationCredential (Get-Credential)

6. Postfix (standalone server)

postconf -e 'relayhost = [relay.mailguard.com.tr]:587'
postconf -e 'smtp_sasl_auth_enable = yes'
postconf -e 'smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd'
postconf -e 'smtp_sasl_security_options = noanonymous'
postconf -e 'smtp_tls_security_level = encrypt'

echo '[relay.mailguard.com.tr]:587 KULLANICI:PAROLA' > /etc/postfix/sasl_passwd
postmap /etc/postfix/sasl_passwd
chmod 600 /etc/postfix/sasl_passwd*
systemctl reload postfix

If you use IP authorization, the smtp_sasl_* lines aren't needed; just relayhost and the TLS setting are enough.

7. Inbound filtering setup

Register your domain with us and tell us the delivery server address.
Change your MX records to mx01 / mx02 (above).
On your own server, add our MX addresses to the trusted list; otherwise your own filter may score our IPs.
Open port 25 on your server only to our MX IP addresses.

Skip step 4 and the filter is useless. Spammers can connect directly to your server's A record without reading the MX record. As long as port 25 stays open to everyone, some traffic will bypass the filter.

8. REST API

You can send over HTTP instead of SMTP. It passes through the same filtering and signing pipeline.

curl -X POST https://api.mailguard.com.tr/v1/send \
  -H "Authorization: Bearer API_ANAHTARINIZ" \
  -H "Content-Type: application/json" \
  -d '{
    "from": "orders@yourdomain.com",
    "to": ["customer@example.com"],
    "subject": "Your order is being prepared",
    "text": "Hello, your order has been received.",
    "html": "<p>Hello, your order has been received.</p>"
  }'

Webhooks

You can set a webhook address for delivery, deferral, bounce and complaint events. API keys are generated from the dashboard, with an optional IP restriction.

The API and dashboard currently run with limited access. To request access, get in touch with us.

9. Troubleshooting

Symptom	Likely cause and fix
Mail won't send, `relay access denied`	Your server IP isn't registered, or no authentication is happening. Send us your IP or set up an SMTP user.
DKIM verification fails	The CNAME record isn't added or points to the wrong target. Check the `mailguard._domainkey` record.
SPF `softfail` / `fail`	A second SPF record may have been created. A domain must have only one SPF record; the `include` is added inside the existing record.
Inbound spam still gets through	Port 25 on your server may be open to everyone, so the sender is bypassing the MX. Restrict the port to our MX addresses.
Sending slowed / throttled	You may have hit a rate limit. You can view the counters in the dashboard and request a limit increase for higher volume.

If you're stuck, send us the message's Message-ID or the time it was sent; we can produce the full transcript of the relevant SMTP session.

MailGuard Documentation