One server, one domain, 33 passing checks

Rent a virtual private server instead of running a box at home: home internet usually changes your IP, blocks mail on port 25 and won't set reverse DNS. Look for:

• A static public IPv4 address, with IPv6 as a bonus
• Root access and a current Ubuntu LTS or Debian image
• 2 or more CPU cores, 4 to 8 GB of memory and 80 GB of SSD for .NET, PostgreSQL and mail
• Outgoing port 25 open, since many cloud hosts block it by default
• A way to set reverse DNS (PTR), by control panel or support ticket
• Snapshots or backups you can restore in minutes

Buy the domain from a registrar, then turn on auto-renew, registrar lock, WHOIS privacy and two-factor sign-in. Decide where DNS lives: only one set of name servers is in charge, and edits anywhere else do nothing. Check which servers answer:

dig NS example.com +short

DNS records point the domain at the server and tell other mail servers to trust its mail. A message reaches the inbox only when these records match the server that sent it:

@                IN  A      203.0.113.10
www              IN  A      203.0.113.10
mail             IN  A      203.0.113.10
@                IN  CAA    0 issue "letsencrypt.org"
@                IN  MX     10 mail.example.com.
@                IN  TXT    "v=spf1 ip4:203.0.113.10 ~all"
mail._domainkey  IN  TXT    "v=DKIM1; k=rsa; p=<public key from the mail server>"
_dmarc           IN  TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Key-based SSH replaces the root password as the only way in. Only the public key goes to the server; each login proves you hold the private key without sending it.

1. Create a key pair on the workstation (Windows 11 ships OpenSSH, so this runs in PowerShell).

   workstationCopy

   ssh-keygen -t ed25519 -C "you@workstation"

2. Sign in as root with the provider's password and create a regular user with sudo rights.

   server · rootCopy

   adduser you
   usermod -aG sudo you

3. Copy the public key to the new user (Windows has no ssh-copy-id, so pipe it).

   workstation · powershellCopy

   type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh you@203.0.113.10 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

4. Turn off password and root logins in a new file.

   /etc/ssh/sshd_config.d/99-hardening.confCopy

   PermitRootLogin no
   PasswordAuthentication no
   KbdInteractiveAuthentication no

5. Restart SSH and open the firewall for only the ports in use.

   serverCopy

   sudo systemctl restart ssh
   sudo ufw allow OpenSSH
   sudo ufw allow 80,443/tcp
   sudo ufw allow 25,465,587,993/tcp
   sudo ufw enable

The workstation needs three tools to start; the AI installs the rest in step 6. On Windows 11:

winget install Git.Git
winget install Microsoft.VisualStudioCode
irm https://claude.ai/install.ps1 | iex

The last line installs Claude Code (on macOS or Linux: curl -fsSL https://claude.ai/install.sh | bash). In VS Code, add the Claude Code, Remote - SSH and C# Dev Kit extensions; Remote - SSH opens a terminal and the file tree on the server itself.

Ask for a script and a verify check, not a "done" message.

A good prompt names the machine, the exact versions, the limits and the proof you want back. Then approve each command as it runs.

This is an Ubuntu 26.04 LTS server for example.com.
Install the ASP.NET Core 10 runtime, PostgreSQL 18, Node.js LTS, Nginx and certbot.

Rules:
- Bind PostgreSQL to localhost only. Never open port 5432 in the firewall.
- Don't change sshd settings or remove any ufw rule.
- Wait for unattended-upgrades to release the apt lock before installing.
- Keep secrets in a root-only file with mode 600, never in the chat.

Write every command to /root/setup.sh so it can run again on a fresh server.
Then write /root/verify.sh that prints OK or FAIL for each service, port,
certificate and DNS record, and run it.

To reach the server's database from the workstation, tunnel to it instead of opening the port; any Postgres client then connects to localhost:5433.

ssh -L 5433:localhost:5432 you@203.0.113.10

Nginx faces the internet on 80 and 443. It serves the built React files and passes API calls to the .NET app on localhost, so Nginx is the only part anyone reaches.

[Unit]
Description=example.com API
After=network.target postgresql.service

[Service]
User=www-data
WorkingDirectory=/opt/app/api
ExecStart=/usr/bin/dotnet /opt/app/api/Api.dll --urls http://127.0.0.1:5000
Restart=always
Environment=ASPNETCORE_ENVIRONMENT=Production

[Install]
WantedBy=multi-user.target

server {
    server_name example.com www.example.com;
    root /var/www/example.com;
    location / { try_files $uri /index.html; }
    location /api/ { proxy_pass http://127.0.0.1:5000; }
}

sudo certbot --nginx -d example.com -d www.example.com

Then the mail server: it generates the DKIM key, published as the mail._domainkey record from step 3. Check everything from outside: