Two MX records for one domain, but only one server should be the receiving one

Question

We have two email servers (sender_and_receiver.example.com and send_only.example.com) which handle the mail exchange for one specific domain (example.com). As the names implies, one server is sending and receiving emails (sender_and_receiver.example.com - this one should take care of incoming emails, with Postfix and Dovecot) and the other one is a send only server (only Postfix as a send-only MTA). The problem we have is that some (not all) incoming emails just don't get delivered. I assume it's a DNS problem. I have set up the following MX records:

CNAME smtp.example.com -> sender_and_receiver.example.com
CNAME imap.example.com -> sender_and_receiver.example.com
MX    @    sender_and_receiver.example.com 10
MX    @    send_only.example.com 30

I think that some senders try to deliver to MX @ send_only.example.com 30 instead to the record with the priority of 10. I would have left only one DNS record, but if I remove the DNS record for the send-only server, it'll get blacklisted.

How can I solve that problem? What is the correct way for such a setup (two email servers, one sending+receiving and one sending only)?

Answer 1

I guess your problem is that send_only.example.com does accept the SMTP connection and then rejects the mail. You can confirm this by connecting to send_only.exmaple.com on port 25 (maybe with telnet) and see if it responds.

If you have an MX listed like that (and you cannot or don't want to remove it) you must make sure it is either accepting your mail or it doesn't accept SMTP connections at all.

If you make sure that send_only.example.com does not accept SMTP connections at all (by firewalling or not binding the MTA on the public interface), every external mailer will be unable to connect to it, so it can only deliver to sender_and_receiver.example.com.

Hope that helps!