Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've an interesting problem that I thought was straightforward, but turns out I think I'm whistling down the wrong path.

It has to do with (shudder) email. I thought I was done with needing to know about email guts ten years ago; I was wrong.


Simply put, I need to figure out how to relay outgoing email that is not targetted in our domain from our domain into a 'dropbox' in a DMZ, and the Other Guys can retrieve that email from their side of the DMZ and distribute it accordingly, even out to the public internet if need be. There will be no [un-established] traffic coming back to Our side from anywhere; any attempts to do so are dropped with malicious prejudice.

Our side is postfix running on scilinux6.1. The DMZ boxes are redhat5.4. The Other Guys are M$ Exchange. The firewalls are set up such that data can go from Our Side downsec to the DMZ, but not upsec from the DMZ into Our Side. Same for the Other Guys.

My first thinking was simply to set up postfix on a box in the DMZ and tell them to set up fetchmail or whatever the M$ equivalent is, but then I started remembering that postfix wants to actively relay email onwards, rather than hold it and wait for someone to 'reach in' and retrieve it.

I'm not sure I've explained this well, but hopefully it's clear enough that someone can point me in the right direction. I seem to remember having done this before, but it was a looong time ago.


share|improve this question
In the 90s we called this FidoNet. Sounds like what you want is to use the DMZ box as a smarthost, and try to deliver all outbound mail to Other Guys, but in this scenario they wouldn't be able to 'retrieve' the mail, just connect to the DMZ box and let it successfully deliver it. – slillibri Nov 30 '11 at 1:19
Very close. More like Our Side drops outgoing mail into a mailbag in the DMZ, and then the Other Guys reach out and pick up the mailbag, and they do the processing and delivery. – user52874 Nov 30 '11 at 1:40

This is why someone invented POP3 and IMAPv4 decades ago. But Microsoft still is not aware of that and is unable to "fetch" mails via POP3. Only if the "other guy" has an Exchange Small Business Server with a POP connector.

So set up a POP3 and/or IMAP server in the DMZ. Or forward the mails directly to the Exchange Server. Straightforward I would say.

share|improve this answer
oh, duh...could it be that easy? I thought POP3/IMAP actually wanted to deliver the mail to the individual mailboxes, rather than convey on a 'bag-o-mail' and let Exchange sort it out? As far as forwarding it on, anything hitting their firewall will go splat; be rejected or dropped. They need to be able to reach through their firewall and retrieve deliveries from the box in the DMZ. – user52874 Nov 30 '11 at 1:09
Do whatever you want. Single mailbox, multiple mailboxes, one per group, one per domain, ... Whatever you do, Exchange can't cope with that. It's a crappy software in that way. – mailq Nov 30 '11 at 1:17

This can be handled by setting up appropriate routing rules on the server in the middle and the two endpoints. The default method for routing is to use DNS MX and/or A records to locate the mail exchange for a domain. First an MX record is used, and if that is not available, the A record is used.

Most MTAs (Mail Transfer Agents) allow manual rules to be configured. Manual rules are often required when acting as a relay server. In this case the DMZ server will act as a relay between the two domains. Configure the mail servers in each of the domains to route to the relay server. Bi-directional access between the DMZ and the internal mail servers will be required. Other than the manual routing, standard mail delivery rules will apply.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.