4
votes

What suppliers can you recommend, that provide an MX backup service?

1
  • 1
    the correct answer is that you don't need a backup MX. See Craig's very thorough answer
    – Alnitak
    Jul 29 '09 at 10:50
16
votes

it used to be the case that having a backup MX was a Good Thing. the internet was unreliable, email was unreliable, smtp was not so common, bang-path addressing and other forms of manually-specified mail routing was common, and uucp was the mail protocol of choice.

That was a long, long time ago. It's not true today. sending MTAs will queue up undelivered mail and keep on trying to deliver it for several days (default is usually 4 or 5 days), so if your mail server is down or unreachable for a few days, your mail will eventually get delivered to you.

Today, except in very specialised circumstances, you do not need a backup MX and, in fact, it will cause you far more problems than you imagine that it might solve (in reality it solves almost no problems).

Unless your backup MX has a list of valid recipients for the domain(s) that it is supposed to receive mail for, it WILL instantly become a source of back-scatter (spam bounces to forged sender addresses). it will also be a potential route for spam to bypass some of your spam filters (because you necessarily trust your MX more than you trust random smtp servers on the net). Many spammers still target backup MX machines in preference to primary MXs for this reason (and also because secondary MXs often have weaker anti-spam filters).

NOTE: when i write "spam", i mean spam AND viruses. from my POV, they're the same thing and are generally sent by the same scumbags anyway (most viruses are spambots of one kind or another).

1st Rule of thumb: unless you know exactly why you need a backup MX and exactly what problems it may cause and exactly how you're going to prevent them, then DO NOT HAVE A BACKUP MX.

2nd Rule of thumb: unless you have complete control over the backup MX and can ensure that it has an up-to-date list of valid recipients, and roughly equivalent spam-filters as your primary MX, DO NOT HAVE A BACKUP MX.

3rd Rule of Thumb: see Rules 1 & 2. If in doubt, DO NOT HAVE A BACKUP MX.

starting to see the pattern?

BTW, you can take advantage of spammers targetting secondary MXs. e.g. i block a lot of spam by running a bogus least-priority MX that responds with 450 tempfail to every delivery attempt. many spambots target that and don't even try the primary MX, so the load on my real mail servers is greatly reduced. Legitimate senders never try it because my mail servers are always on (and if by some chance they aren't, the sender gets a 450 temporary failure code and tries again later)

5
  • You can silently blackhole incoming spam from a secondary MX host at your primary MX as easily as you can coming from other servers. In fact, it's probably easier since you know who your secondary MX's are. Jul 28 '09 at 23:56
  • 2
    @Evan: yep, but you can't 5xx reject it as that will cause the secondary MX to generate a bounce, possibly/probably causing backscatter. by contrast, if the secondary MX had adequate spam-filtering (and a list of valid recipients) then it could 5xx reject it without risk of backscatter. once any of your MXs have accepted the mail, your only good choices are to deliver it or discard it - bouncing it is not a good option.
    – cas
    Jul 29 '09 at 1:30
  • @Craig: That's why I said "silently blackhole". (I also think that no SMTP servers should be generating bounce messages bound for the Internet. Backscatter has ruined that "feature" of the protocol for all of us.) Jul 29 '09 at 3:11
  • @Evan: again, yep. i was writing to clarify for others, not to dispute what you said. it's the Good, the Bad, and the Ugly: to 5xx Reject undeliverable/invalid/unwanted mail is Good, discarding (silently blackhole) it is Bad but sometimes necessary, and accept-and-bounce is Ugly.
    – cas
    Jul 29 '09 at 6:50
  • I know I'm years behind this thread, but I just saw it today in my search for a backup MX service. @Craig - I understand your position and I tend to agree. It makes me wonder if I couldn't just throw together some code that simply acts as a "responder" to send out the 450 temp fail messages. Seems simpler than setting up and running a complete postfix setup just for that purpose... And, not to re-invent the wheel, but is there already something out there in the Unix world that does this? Jun 27 '13 at 3:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.