5

I'm just setting up dovecat and postfix for the first time and wondering why so many companies are using subdomains for IMAP and SMTP like smtp.mail.example.com and imap.mail.example.com?

What are the benefits or would it be also okay to use just example.com?

I'm asking because I apparently have to use a trusted SSL certificate because some big email service providers refuse to deliver emails to the standard self assigned certificates. It would just be cheaper to use an SSL certificate without wildcards.

So what is it good for to use subdomains?

Improve this question
3
  • 4
    smtp.mail.example.com? - I don't think I've personally seen any of that. What I have seen is smtp.example.com, or mail.example.com, etc.
    – joeqwerty
    Jun 19, 2015 at 0:31
  • hink smtp.mail.yahoo.com - but still, why is it good use to use subdomains for emails?
    – sleepless
    Jun 19, 2015 at 0:39
  • 5
    You'll have a wide variety of serious problems if you name a server using the naked domain name. The first being that the server won't be able to tell what its domain is.
    – Michael Hampton
    Jun 19, 2015 at 2:56

6 Answers 6

Reset to default
9

The main reason to use a domain like mail.example.com or smtp.example.com to enable moving it without impacting other services running on the main domain. Only computers should be looking up the SMTP server, and that will be using the MX record for example.com Your users may need to provide the domains when setting up their client, but many (most?) will guess correctly based on their [email protected] email address.

With very few exceptions, only spambots use a second level (example.com), almost always spoofed, domain. The few legitimate servers using domains like example.com are usually broken in several other respects as well. Using a second level domain can contribute to the spam score for mail you are sending.

Professional administrators use dedicated sub-domains for mail services. In most cases, this will be a sub-domain that does not reflect the name of server on which the service is running.

I haven't had any problems sending or receiving SMTP mail on my server with a self-signed cert. The connecting site already knows it has the correct site based on your MX record. Recently, I have had a couple of servers fail on the startTLS command, but they reconnected without TLS. I believe they were using SSLv3 and got rejected on that basis, rather than a CA basis. A review of the most recent failures shows that spambots are disconnecting incorrectly generating errors. A significant portion of my email traffic is now TLS encrypted and there is no problems the certificate from my self-signed CA.

Using trusted certificates is one way to authenticate co-operating servers within a domain. However, you would want to either restrict the signed domains or use a private (self-signed) CA. There are other cases, such as a VPN, where you might also use a private CA.

Where you may run into issues is with Dovecot, but it will be your users who will be connecting. This is not a service for the general public to use. If you generated a CA to sign your certificate, you can make the CA certificate available to your users to import into their email client. This will resolve the issue.

You can get a signed certificate for free now. If not, the Let's Encrypt Certificate Authority should be available this fall. (It is now available.)

Improve this answer
3
  • Thank you and all others for the explanation. It helped me a lot to set it all up properly.
    – sleepless
    Jun 19, 2015 at 22:50
  • 2
    I disagree with @BillThor in his assertion that sub domains are almost exclusively used by spammers. From my own experience, this is a legitimate way to protect the reputation of a root domain if you are sending bulk email for any number of reasons. As a marketer sending newsletters or other types of marketing material, setting up a subdomain is a great way to protect your root domain from reputation issues.
    – Tyson Navarre
    Dec 3, 2019 at 20:14
  • @TysonNavarre Spammers often don't use sub-domains for the sending hostname. It is rare that a legitimate sender does not use a sub-domain.
    – BillThor
    Dec 6, 2019 at 19:40
3

Just to correct @Ram.

MX record MUST NOT point to "example.com" as per RFC specifications. That is completely wrong. You must instead point an MX record to your "mail.example.com" record and point your "mail.example.com" record to your server IP.

Improve this answer
1
  • 2
    Source RFC and section, please. RFC 5321, 5.1 "If an empty list of MXs is returned, the address is treated as if it was associated with an implicit MX RR, with a preference of 0, pointing to that host.", making MX to self unnecessary, not forbidden. If the domain doesn't accept mail at all there would be a "Null MX" No Service Resource Record, RFC 7505). RFC 2181, 10.3 explains why MX resource record must not be an alias.
    – Esa Jokinen
    May 10, 2017 at 8:50
1

It comes down to where your MX records are pointing to. If your MX records are pointing to example.com instead of mail.example.com and example.com is resolving to an IP address, you can run your SMTP on that server.

It works for personal or small office setups but bigger organizations have specialized servers for each of the functions.

Improve this answer
1
1

mail.example.com is not necessarily a subdomain.

mail.example.com is usually set up as an A and MX DNS records for mail to example.com

Improve this answer
4
  • 3
    Technically an A record is a subdomain, but you're right in that most people don't think of them that way.
    – joeqwerty
    Jun 19, 2015 at 5:50
  • 1
    @joeqwerty example.com is a subdomain of com. example.com is one of several domains reserved for documentation. That aside, organizations with large server may farms under, may have subdomains under mail or smtp that they use for sending email. It is unusual, and not recommended, to name a host mail, in which case the domain name mail.example.com could be the FQDN (Fully Qualified Domain Name) of a host.
    – BillThor
    Jun 19, 2015 at 10:29
  • 1
    @BillThor: I was just pointing out that everything to the left of the TLD that is separated by a period is technically a subdomain. - com is a subdomain of . - example is a subdomain of com, - mail is a subdomain of example, etc., etc. While an A record of mail.example.com may be the FQDN of a host, it is in fact technically a subdomain of example.com. That being said, I've never personally seen a mail server with an A record of smtp.mail.example.com or anything like it. I have seen a lot of smtp.example.com and mail.example.com.
    – joeqwerty
    Jun 19, 2015 at 14:55
  • 1
    To clarify: I'm not referring to the name itself, I'm referring to it's position in the DNS hierarchy.
    – joeqwerty
    Jun 19, 2015 at 15:10
1

A server is supposed to have a "fully qualified domain name" (see https://en.wikipedia.org/wiki/Fully_qualified_domain_name). In your example, calling it just "example.com" would be partially qualified because it's a domain name without a server name.

In practice, many spam filters treat any server that doesn't have a proper FQDN with a great deal of suspicion. Even a name of the form 123.123.123.123.example.com would probably get you blacklisted because it's obviously automatically generated and hence probably a temporary (virtual) machine used to avoid spam blocking filters.

So you have to call it something.example.com and the reason people use "mail" for the "something" is simply that it's memorable and easy to guess. If you create an email account in an email client it will sometimes guess this, saving the user the trouble of trying to find out the server name.

Improve this answer
1

By the past, i think many sys admins have chosen mail.example.com over example.com because they used to host the mail server on a different server with a different IP address than their web server by adding a different A record to mail.example.com

Today, all the major web hosting control panel (cpanel, directadmin, plesk...) setup all the services (http,ftp,smtp,imap,pop) on the same machine. Consequently, there is no need adding a subdomain since it would point to the same server IP.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .