Single DNS and E-Mail server with multiple public IP addresses

Question

On our site we have two internet providers, with public IPs on each link. We manage locally our DNS and SMTP server.

We want to publish our DNS and SMTP server on both links, to get redundancy.

My question is how to publish the NS records and especially the PTR records?

For example, let assume this :

• link1:

  • dns server public ip : 192.168.1.2
  • mail server public ip : 192.168.1.3

• link 2:

  • dns server public ip : 10.10.10.2
  • mail server public ip : 10.10.10.3

How can we declare the name server and the smtp server and especially their PTR records on each link?

Does the SMTP banner matter if we use different names for the SMTP server on each link?

Regards.

Answer 1

Note that having the same DNS server listed under two IP addresses only gives you redundancy against failure of one of the internet connections, not against failure of the one DNS server. Most domain registrars demand at least two DNS servers in two different networks. This setup doesn't meet that requirement, although they will not be able to tell from the addresses that your two name servers refer to the same machine.

For the DNS server names, you set them up the same you would with two different servers at two different addresses. You must either use names that are not in your domain, or you must use glue records, but you have to do this anyway.

Does the SMTP banner matter if we use different names for the SMTP server on each link?

There is not requirement that the SMTP banner uses the exact host name. The RFC regarding SMTP talks about content the greeting MAY contain, but there isn't anything the greeting MUST contain, except the status code.

The question is, do you want to use different names for the IP addresses of the same SMTP server?

One argument for different names for the same SMTP server is if you want to give different priorities to the different IP addresses. You would do this if you have a preference which link should be used for incoming emails. In this case, you would use something like this, for a preference for provider1.

example.de IN MX 10 mail-provider1
example.de IN MX 20 mail-provider2
mail-provider1.example.de IN A 192.168.1.3
mail-provider2.example.de IN A 10.10.10.3

If you consider both links equal, you can specify just one name and list both addresses for that name. Most clients would select an address at random, giving you a load balancing. Clever clients might figure out which address is better connected to them and use that.

example.de IN MX 10 mail
mail.example.de IN A 192.168.1.3
mail.example.de IN A 10.10.10.3

You can get load balancing also by listing two names with the same priority.

example.de IN MX 10 mail-provider1
example.de IN MX 10 mail-provider2
mail-provider1.example.de IN A 192.168.1.3
mail-provider2.example.de IN A 10.10.10.3

One argument for different names is that you don't know how some email client may react is it does a reverse lookup on the IP address and then a lookup on the name and gets more than one IP address. Although there is nothing wrong with that, you don't know how all the clients used today would react to that, and you don't know how future clients may react to that. The main reason for those checks is to prevent SPAM from SMTP clients with incomplete DNS setup, but it's not like a spammer can't setup DNS.

Answer 2

The following configurations refer to the way you would perform configuration with bind(9).

For the NS records, you can simply let your upstream DNS provider point to two servers like:

example.de IN NS ns1.example.com   #This could be 192.168.1.2
           IN NS ns2.example.com   #This could be 10.10.10.2    

For the MX records you can even set a priority which is calles preference. The lowest value will be chosen first. The default preference value is 100.

example.de IN MX 10 mail1          #This could be 192.168.1.3, where 10 is the preference 
           IN MX 20 mail2          #This could be 10.10.10.3, where 20 is the preference   

As you have different domain names for the services at each WAN link, there would not be any problems with PTR records.