In short: I need to setup backup MX server, which will queue messages it receives for later delivery through original MX, AND it must only accept messages for mailboxes which will be listed in $some_file.

Details: mail system on main mail server - let's say its mx.example.com - is set up like this:

  • LDAP for authentication and storing mail
  • Postfix as MTA
  • dovecot, amavisd-new and milter-greylist.

So idea with $some_file is:

  • parse LDAP database to get domains list and mailboxes list with output in $some_file

How it should be done according to some people:

  1. When main mx.example.com is not available due to some reason, backup MX backup.example.com starts accepting mail for delivery (MX record priorities come in handy) and put it in queue, but only for domains/mailboxes listed in $some_file
  2. After mx.example.com is back online, queue formed on backup.example.com is transferred to former MX to be processed.

So this is where I scratch my head and start googling how to do this, but no luck so far.

Questions that I'd love to get answers on or at least receive some hints (maybe links to some articles?):

  • Is it at all possible to perform such a setup of backup MX?
  • Which MTA can do things I described: postfix, sendmail, exim?
  • If so, how?

I understand that on backup MX I'll need to have at least same greylisting setup as on main MX to prevent spam.

We have a different, much (?) easier in realization setup for backup MX, where such sort of relaying is done using sendmail with option in sendmail.cf:

# Hosts for which relaying is permitted ($=R) 
FR-o /etc/mail/relay-domains %[^\#]

where relay-domains contains list of domains allowed to relay mail to main MX. But I'm very curios if you can provide answers and some help. Thank you in advance.

  • Just to be crystal clear, this is for inbound emails (from Internet to recipients at your domain)... right? – Mike B Jul 2 '14 at 23:28
  • @MikeB yes, from Internet to recipients at mine domainS - there are many of those, its for shared hosting setup. So many domains/mailboxes which use our MXes to receive/send mail. – kK-Storm Jul 3 '14 at 8:22
  • Note that while the intention is for backup MX entries only to be contacted when the primary fails, they can be contacted at any time - both for legit mail and spam - some spammers, as well as bots looking for open relays, try the backup MX entries first, on the assumption that they're likely to have weaker spam controls. – thomasrutter Nov 14 '17 at 22:29

Besides as primary mx, Postfix can be used as backup mx too. It has documentation how to setup one in Configuring Postfix as primary or backup MX host for a remote site.

Basically you have two file with the content (1) list of valid domain (e.g. domain of primary mx) and (2) list of valid user (e.g. email address handled by primary mx). For example we save file (1) in /etc/postfix/validdomain and file (2) in /etc/postfix/validuser. Don't forget to postmap both files.

In main.cf of backup MX, add/edit so it has following entry

relay_domains = hash:/etc/postfix/validdomain
relay_recipient_maps = hash:/etc/postfix/validuser

File validdomain is used to verify which domain can be accepted. File validuser is used to verify which user can be accepted. If postfix just use validdomain without validuser, your backup MX will accept non-existing user and become source of backscatter.

  • Thanks, this sounds just right what I need. Will try to do as you say. – kK-Storm Jul 3 '14 at 8:27

Using postfix you can do as follow in your postfix main.cf:

1: go to your MX backup server and add permit_mx_backup to your smtpd_recipient_restrictions
2: always in your MX backup server 
relay_domains = $mydestination domain1.com domain2.net domain3.org

If you want you use file for specified the domains you can do

touch /etc/postfix/domains
echo "domain1.com" > /etc/postfix/domains
echo "domain2.com" >> /etc/postfix/domains
echo "domain3.org" >> /etc/postfix/domains
postmap /etc/postfix/domains

and modified the provious directive in this way:

relay_domains = $mydestination, hash:/etc/postfix/domains

after this, you can reload the postfix service, and remember beforce put a mx backup server on internet, you need to be sure, you are not creating an open relay

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.