0

I'm appealing to the wise to confirm what I am guessing to be true. I have a firewall with 2 active WAN interfaces, call them WAN1 and WAN2. MX records point from outside to WAN1. The first time I plugged in WAN2, I was blackslisted in about 20 minutes since mail was flowing out both WAN interfaces. Return route checking only verified on WAN1, so I was a "spammer" on WAN2. I don't want THAT to happen again.

So, do I static route my local mail IP to WAN1? Seems obvious, but I'd rather ask before borking my mail system again.

Firewall stats: Watchguard Firebox X750 Core w/WSM 11.4

WAN1: T1 (expensive, reliable, tiny bandwidth)...primary (lowest order) WAN interface

WAN2: DSL (cheap, unreliable, bigger bandwidth)

1 Answer 1

1

Outgoing email does not need to be sent by your MX. However, it is expected to come from a static address. The name your server uses in the HELO command should match the PTR record on the IP address it is using.

If you don't have a static address for your DSL line, use static routing to keep your email on the T1 link.

If you have static IP addresses on both then ensure that both addresses are properly configured to send email. You should configure your system so that it will always route over the same inferface. (I assume all of this is done for the T1 interface.)

  • Configure A records for both interfaces. These should be at least three levels deep. (For example use mail.example.com and mx.example.com.)
  • Have the PTR records for the IP address configured to return the name on the A record. This enables forward rDNS validation.
  • If you use SPF, configure the domain to allow either address to send email (v=spf1 ms a:mail.example.com ~all).
  • If you use SPF, configure SPF for the mail servers addresses (v=spf1 a -all).
  • Configure your mail server so it uses the appropriate name in the HELO command.

You could use a single name for mail transfer on both interfaces. The two PTR records would return the same name of your MX in this case.

2
  • BillThor... Your response is very much appreciated. I understand the reply and will implement as you advise. My thanks for being a contributing member of Serverfault. I am surprised and happy to have received a clear answer from a knowledgeable professional so quickly. Viva la Internet! Mar 31, 2011 at 0:46
  • @Jereme: Glad to be of help.
    – BillThor
    Mar 31, 2011 at 3:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .