0

We have two email servers (sender_and_receiver.example.com and send_only.example.com) which handle the mail exchange for one specific domain (example.com). As the names implies, one server is sending and receiving emails (sender_and_receiver.example.com - this one should take care of incoming emails, with Postfix and Dovecot) and the other one is a send only server (only Postfix as a send-only MTA). The problem we have is that some (not all) incoming emails just don't get delivered. I assume it's a DNS problem. I have set up the following MX records:

CNAME smtp.example.com -> sender_and_receiver.example.com
CNAME imap.example.com -> sender_and_receiver.example.com
MX    @    sender_and_receiver.example.com 10
MX    @    send_only.example.com 30

I think that some senders try to deliver to MX @ send_only.example.com 30 instead to the record with the priority of 10. I would have left only one DNS record, but if I remove the DNS record for the send-only server, it'll get blacklisted.

How can I solve that problem? What is the correct way for such a setup (two email servers, one sending+receiving and one sending only)?

manifestor
  • 6,079
  • 7
  • 27
  • 39
  • 1
    For your send_only server, why do you even have an MX record? MX records state where email should GO, not where it can be sent from. So long as the send-only server has a valid A record and PTR, you should be good. Why not just remove the MX entry for it completely? – Ackack Mar 25 '21 at 16:09
  • @tilleyc - I absolutely disagree, see https://serverfault.com/questions/947145/is-an-mx-record-required-on-a-domain-to-send-emails-only – manifestor Mar 25 '21 at 19:07

1 Answers1

0

I guess your problem is that send_only.example.com does accept the SMTP connection and then rejects the mail. You can confirm this by connecting to send_only.exmaple.com on port 25 (maybe with telnet) and see if it responds.

If you have an MX listed like that (and you cannot or don't want to remove it) you must make sure it is either accepting your mail or it doesn't accept SMTP connections at all.

If you make sure that send_only.example.com does not accept SMTP connections at all (by firewalling or not binding the MTA on the public interface), every external mailer will be unable to connect to it, so it can only deliver to sender_and_receiver.example.com.

Hope that helps!

Andreas Rogge
  • 2,853
  • 11
  • 24
  • Hi Andreas, thanks for your reply! The send-only Postfix already listens only on it's local interface and doesn't accept any SMTP connections at all :( – manifestor Mar 25 '21 at 13:50
  • If that is the case, the the MX record is not your problem. What e-mail doesn't get delivered? What is in the sender MTA's logfile? – Andreas Rogge Mar 25 '21 at 14:04