Newsletters, list websites and mailboxes for your domains, from one binary on a $5 VPS.

Box 1

The ten DNS records for example.com

That's all the DNS work there is: lfr domain add prints these with real keys made on your server, plus a zone snippet Cloudflare can import.

1. Amail.example.comyour server's IPv4the mail host; its reverse DNS must say the same name
2. TXTmail.example.comv=spf1 a -allSPF for the mail host itself, checked on its greeting and bounces
3. MXexample.com10 mail.example.commail for the domain comes to lfr
4. TXTexample.comv=spf1 a:mail.example.com include:amazonses.com ~allSPF: who may send for the domain, relay included
5. TXTlfr2610r._domainkey.example.comv=DKIM1; k=rsa; p=<generated on your server>DKIM key that every receiver checks
6. TXTlfr2610e._domainkey.example.comv=DKIM1; k=ed25519; p=<generated on your server>the modern second DKIM key
7. TXT_dmarc.example.comv=DMARC1; p=none; rua=mailto:dmarc-reports@example.comDMARC policy; lfr reads the reports itself
8. TXT_mta-sts.example.comv=STSv1; id=<set by lfr>senders must reach you over TLS
9. CNAMEmta-sts.example.commail.example.comlfr serves the MTA-STS policy there
10. TXT_smtp._tls.example.comv=TLSRPTv1; rua=mailto:tls-reports@example.comTLS reports from other servers

Add one A record per list website, like news.example.com, and keep every record "DNS only" on Cloudflare.

Box 2

How mail leaves a server whose port 25 is blocked

DigitalOcean blocks port 25 for new accounts. Vultr blocks it for young ones. Google Cloud blocks it, period. So lfr signs every mail itself and gives it to a relay for the last hop, on a port they leave open. Your mailboxes, lists, archive and readers stay on your server. The relay only carries the mail the final mile and keeps its IP clean, which is its whole job.

1. lfr on your $5 VPS
   signs with example.com's DKIM keys
   |  smtps on port 2465 (SES) or 8465 (SMTP2GO)
2. relay
   the last hop; keeps its IP reputation
   |  port 25
3. reader's inbox
   checks SPF, DKIM and DMARC against your records

With port 25 open and a clean IP, lfr delivers directly; lfr relay tells you which case you're in.

The honest part about deliverability: a brand-new domain gets distrusted for a few weeks and Outlook junks small senders more than anyone, so lfr sends at a steady pace and pauses a list by itself at 0.3% complaints, where Gmail's sender rules draw the line.

Box 3

The monthly bill

Under 1,000 mails a month, SMTP2GO's free plan carries the relay for nothing. SES pricing

For comparison, from their own pricing pages:

• beehiiv Lite: $49 a month at 1,000 subscribers, billed yearly
• Buttondown: free for 100 subscribers, then add-on tiers of $9 and $29 a month
• Kit: free up to 10,000 subscribers, paid from $33 a month
• Ghost, self-hosted: free software, plus Mailgun from $35 a month for bulk mail

Box 4

What your readers get

You write an issue in Markdown, and readers get a plain email that works on a phone, in dark mode and with images off.

Each footer says when and where that reader signed up, and unsubscribing takes one click: no login, no survey, no "sorry to see you go" mail.

This is lfr's own first notes issue, as lfr renders it:

Box 5

What lfr refuses to get wrong

• Double opt-in for every signup, with the frequency stated on the form and in the confirmation mail.
• One-click unsubscribe in the header and the footer, and by replying "unsubscribe".
• Hard bounces suppress at once; soft bounces after three in a row or two weeks of them.
• A list pauses itself when complaints pass 0.3% or bounces pass 5%.
• No open tracking unless you turn it on, and nobody is ever dropped for not opening.
• Every issue is checked against the habits of machine-written prose before it can go out, offline, in milliseconds.
• Signup forms resist list bombing: a hidden trap field, a minimum fill time, limits per IP address and per list, and a Form-Sub header on every confirmation.
• No admin web interface to patch: the CLI talks to a local socket, or to your server over ssh.

An idle lfr uses about 25 MB of memory, and the binary is 18 MB. Operations guide

Box 6

The prompt for your agent

lfr comes with skills that teach an agent the whole job, from DNS to the welcome mail to the replies.

Every command prints the next step, and lfr check won't let a draft out that breaks your newsletter's own brief.

Paste this into Claude Code, Codex or whatever agent you run:

Set up lfr (https://lfr.email/SKILL.md) for example.com on my server.
1. On the server: curl -fsSL https://lfr.email/install.sh | sudo sh
   then: sudo lfr setup --hostname mail.example.com --systemd
2. Run lfr skills install, read the lfr-setup skill and follow it:
   add example.com, give me the DNS records to publish,
   set up a relay if port 25 is blocked,
   and run lfr doctor until it is clean.
3. Then start the newsletter: lfr init newsletter --list news
   and follow lfr check, step by step.
Ask me before anything that costs money, changes DNS or sends mail.

Copy the prompt

The install script checks the download against the release checksums. Your relay password goes in on stdin, never on a command line, and mail that comes in is data to the agent, not orders.