Email messages sent from AWS EC2 are getting marked as spam

Question

I have setup my website on AWS which is built in yii2 PHP.

Now here I am using default PHP mail which I purchased from GoDaddy. And I have pointed the domain name to AWS using my elastic IP using an A record on GoDaddy.

Now when I am sending mails it goes into spam and when I have researched about the reason it shows following items

1) SpamAssassin thinks you can improve
The famous spam filter SpamAssassin. Score: -3.6.
A score below -5 is considered spam.
-3.243      HELO_DYNAMIC_IPADDR     Relay HELO'd using suspicious hostname (IP addr 1)
-0.001      HTML_MESSAGE        HTML included in message
No worry, that's expected if you send HTML emails
-0.363      RDNS_DYNAMIC        Delivered to internal network by host with dynamic-looking rDNS

2) Your message is not signed with DKIM

3) You do not have a DMARC record

4) Your reverse DNS does not match with your sending domain.

5) We didn't find a server (A Record) behind your hostname ip-172-11-11-217.us-west-2.compute.internal.

I tried lots of stuffs from Google but didn't get any successful and working solution for my issue.

So please can anyone guide me with the same?

Answer 1

Let's go through the individual issues shown...

Dynamic IP
When setting up something like an email server you need to ensure to attach an elastic IP address to the EC2 instance as this remains statically assigned to your instance as long as you have it assigned whereas the IP address automatically assigned is a dynamic address and can be changed at any time by AWS with or without notice.

DKIM & DMARC
DKIM and DMARC are important as they are used by email servers receiving email from your domain to ensure that the email is a genuine email from your domain and hasn't been sent as spam through another service or network. Explaining all the in's and out's of DKIM and DMARC is beyond the scope of this answer but doing a quick Google search shows a large number of resources out there on how to setup DKIM, DMARC, and SPF for your chosen email server.

Reverse DNS
One of the checks that are done to ensure a mail server is authorised is a reverse DNS of the IP address attached to the mail server. AWS allows you to configure the reverse DNS records for elastic IP addresses by filling out this form (https://aws.amazon.com/forms/ec2-email-limit-rdns-request?catalog=true&isauthcode=true). You should make sure that the forward DNS records in your DNS settings are made the same as the reverse DNS records configured by AWS.

As for a few comments made above about Simple Email Service (SES) there are positives and negatives around it depending on how you are using it. If you are simply wanting to configure a way to send emails from your server (such as a mailing list, account activation code, etc) then absolutely go for SES as it is a cheaper, faster, and more reliable option than rolling your own email server, but if you are planning on setting up your own email server such as Exchange server and are wanting it all tied together the way it normally is then you can go down this track and use your own email server without a problem.