Working on DigitalOcean: Services, Account Security, Billing and Email Limits

DigitalOcean built its reputation on simplicity: a clean control panel, predictable pricing and documentation written for developers rather than procurement teams. This guide covers the services that make up the platform, the account security settings worth enabling on day one, how billing works, and the email-sending restriction that surprises many new users. For choosing a Droplet plan and region, see our DigitalOcean Droplets guide.

What you can build on DigitalOcean #

Developers use DigitalOcean for side projects, client work and API backends where a simpler platform is preferable to a hyperscaler. Startups run production on Droplets plus Managed Databases, then add DOKS as they grow. Agencies typically ask each client to own their team account and grant the agency access as a member, which keeps billing and ownership with the client.

Securing a DigitalOcean account #

1. Use a strong, unique password for the account and enable two-factor authentication.
2. Use SSH keys, not passwords, for Droplet access. Add your public key when creating Droplets and disable password login on the server.
3. Enable billing alerts so you are emailed when month-to-date usage crosses a threshold.
4. Attach Cloud Firewalls to Droplets and allow only the ports you need. Restrict SSH to known IP addresses where possible.
5. Use Teams with member roles instead of sharing one login, and review members regularly.
6. Review API tokens and give each integration a token with the narrowest scope and an expiry.

Management essentials #

• Tags and projects: group Droplets, databases and Spaces into Projects and tag resources by environment or client.
• Monitoring: enable the monitoring agent on Droplets and set resource alerts for CPU, memory and disk.
• Backups and snapshots: enable automatic backups for important Droplets and take snapshots before risky changes.
• API and CLI: the DigitalOcean API and the doctl CLI cover everything the control panel does, which makes repeatable setups easy.

How DigitalOcean billing works #

• Hourly billing with monthly caps. Droplets are billed by the hour, and each plan has a monthly cap, so you never pay more than the monthly price no matter how many hours it runs. Basic Droplets start at a few dollars per month; check the official pricing page for current figures.
• Powered-off Droplets still bill because their disk and IP are reserved. Destroy Droplets you no longer need rather than powering them off.
• Bandwidth: each Droplet includes a monthly transfer allowance pooled across the account; overage is charged per gigabyte.
• Promotional credit: new accounts are often offered a promotional credit valid for a limited period, subject to DigitalOcean’s current terms. Credit applies to usage on that account and is not transferable.
• Free App Platform tier: static sites can be built and deployed at no cost, and the Kubernetes control plane is free.

Cost habits that work: set a billing alert, right-size Droplets, destroy unused resources, and watch bandwidth on media-heavy sites. Our guide to budgets and billing alerts covers where the setting lives.

Email from a Droplet: SMTP ports are blocked #

DigitalOcean blocks outbound SMTP on ports 25, 465 and 587 on Droplets by default to prevent spam and protect the reputation of its IP ranges. Self-hosted mail servers are hard to secure, are frequently flagged as spam and need constant reputation monitoring, so the platform pushes email through dedicated providers instead.

The supported approaches are:

• Use a transactional email service such as SendGrid, Mailgun, Postmark or Amazon SES over its HTTPS API, which avoids the port block entirely.
• Request an unblock through a support ticket. DigitalOcean grants these case by case, typically for established accounts with a clear, legitimate use case, and an unblock is not guaranteed.
• Use an alternative submission port such as 2525 if your email provider supports it.

Searches for a “port 25 open” DigitalOcean account miss the point: the block applies to all new accounts, and the right plan is to design around it. Our guide to SMTP port 25 on cloud servers compares how each provider handles this, and SPF, DKIM and DMARC explains the authentication records you need whichever route you take.

A first-week checklist #

1. Enable two-factor authentication and add your SSH public key to the account.
2. Set a billing alert before creating the first Droplet.
3. Create a Project per environment or client and tag resources as you go.
4. Create a Cloud Firewall that allows only HTTP, HTTPS and SSH from your address, and attach it to every Droplet.
5. Enable backups on anything you would miss and take a snapshot before major changes.
6. Decide how email will be sent (an API provider is the default answer) before the application needs it.

Official references #

The DigitalOcean documentation covers products, billing and the SMTP policy in detail. Our DigitalOcean platform overview summarizes the platform and its official sign-up process.

Frequently asked questions #

Can I send email from my DigitalOcean Droplet?

Not directly over SMTP by default, because ports 25, 465 and 587 are blocked. Use an email API provider, or ask support for an unblock, which is granted case by case.

How do I manage my account?

Through the control panel in a browser, or the API and doctl CLI for automation.

Does a powered-off Droplet cost money?

Yes. Billing continues until the Droplet is destroyed, because its disk and IP address remain allocated.