I have a mail server set up as mail.mydomain.com like most people do. Now I find out that if I want to secure both mail.mydomain.com and mydomain.com with ssl I need two SSl certificates (or one more versatile but more expensive certificate).

Does it make sense to run my mail server under mydomain.com (it is the same physical machine anyway) to save certificate expenses (I am Dutch) or is this being pound foolish? What is the rationale of separating the mail server from the 'www' server apart from the intuitive 'neatness' appeal?


Running your mail server as example.com rather than mail.example.com may cause some severs to classify the mail as spam. Almost incoming main I have seen using second level domain names in the HELO message are spam. Most claim to be high recognition domains like gmail.com, yahoo.com, ups.com, or fedex.com. These domains actually use sub-domains for their mail servers.

Multi-domain certificates are available. Or you can use the same third level domain for everything. Providing services on the second level domain is problematic on a number of levels. It is common to have a web server at this level, but except for purpose driven domains like serverfault.com, it is also common for them to redirect to a sub-domain.


Running the mail server as just mydomain.com will not be a problem if done right. The reason you see multiple host names even on the same system is to allow for easy migration if necessary (e.g. because your site grows and you have to off-load the mail from the web server), so you have to take that into account: You could end up with higher costs and the difficulties to reconfigure your system afterwards.

Also, depending on who your clients are, you don't strictly need a signed SSL certificate - using self-signed certificates work quite well if you can communicate the issues to your users.


Reasons to have mail subdomains: *multiple MX records *decouple host name from service (this can be done by NAT too.)

Look into a wildcard cert. Going the self-signed route trains users to do bad things.

  • thanks but I'm not sure what you mean by 'multiple MX records' and 'decouple host name from service'. As to wild card, in my case a multiple domain certificate makes more sense as I only have two subdomains. The remaining credits I can then use for other domains.
    – zensys
    Jun 17 '12 at 20:44
  • By decouple I mean that you can have the mail service eventually move to another machine if you need to without having to make any changes to configuration of your MTA. Edit because pressing enter ends a comment. Anyway as for MX, you can define multiple records for a domain as mail exchanges in case your primary server is unreachable. I am not sure which mail and DNS servers you are using, but here's the documentation for postfix and BIND
    – jmw
    Jun 17 '12 at 21:54
  • Clear. my mail and main domain are on the same server/physical machine so one cannot be the backup for the other. For that I use my (VPS-) hosting provider.
    – zensys
    Jun 18 '12 at 5:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.