I have one mail server, one SonicWall firewall, two Internet providers, and an internal DNS server. I have WAN failover set up on the SonicWall so in the event that the primary connection is down users will get out on the secondary connection. The mail server is accessible from outside via either ISP.

mail.mydomain.com uses the primary Internet connection, and is the primary MX record.

mail2.mydomain.com uses the secondary Internet connection, and is the secondary MX record.

Webmail, mail clients and smartphones can use either address to connect when outside the LAN (only mail.mydomain.com works internally because of the internal DNS server), but when the primary ISP is down users need to know to use mail2.mydomain.com and smartphones don't connect as they are configured for mail.mydomain.com

I'd like to automatically detect when the primary Internet connection is down so mail.mydomain.com connects over either WAN connection.

I think BGP and DNS failover are my options, and I'm wondering if a load balancer is a possible solution and how that would fit into the setup. BGP is not an option with the internet providers I have. DNS failover with dyn.com or dnsmadeeasy.com is an option, but I'm concerned that the user's ISPs won't respect the short TTL and this won't be effective for short outages.

  • Alternatively use a NAT hairpin then it won't matter whether primary or secondary are down as the sonicwall will always route it back to primary on the internal side. Assuming I've understood what you mean that should be a way forward.
    – hookenz
    Nov 21, 2013 at 5:23
  • Hairpin NAT wouldn't solve this. The primary domain already works internally because I have a DNS server on the LAN. My concern is for remote users when the primary is down.
    – ridogi
    Nov 21, 2013 at 18:13

2 Answers 2


If you place the load balancing function outside your wan links such that it has its own public ip address(external to your network) to point your clients at, you can configure it to reverse-proxy to services at both your wan link ip addresses. Such a design would make for load balancing and failover without bgp.

I guess you could co-locate a redundant load balancer, use a cloud service or similar, as long as you procure for very high uptime. You would ideally want it to be more reliable than both your wan links when seen as a bundle.


For this situation (and this situation only) I'd use DNS entries with a low TTL and some type of dynamic monitoring.

In the standard case, mail points to your primary IP number, possibly via a CNAME. If that network link goes down, you make a DNS change and switch the CNAME over to your backup. Automate this as necessary (possibly using the SonicWall itself, or see below) and make sure the TTLs on the CNAME and A records are sufficiently low to avoid caching. Say half as long as an outage you are able to tolerate.

The real issue is webmail/mail clients. The MX records you have setup already should handle the inbound mail in the standard case or in case of an outage on either link.

See, e.g.: http://www.dnsmadeeasy.com/services/dns-failover-system-monitoring/ (A records only)


  • What is your experience with DNS failover for short outages?
    – ridogi
    Nov 21, 2013 at 21:29
  • It all depends on your TTL.
    – dmourati
    Nov 21, 2013 at 22:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.