ZCS Administrator Guide 8.0

Network Edition

Configuring IMAP and POP Proxy Server

Use of an IMAP/POP proxy server allows routing users of these services to the Zimbra mailbox server on which their mailbox resides. For example, proxying allows users to enter imap.example.com as their IMAP server. The proxy running on imap.example.com inspects their IMAP traffic, does a lookup to determine which backend mailbox server a user’s mailbox lives on (mbs1.example.com, for example), and transparently proxies the connection from user’s IMAP client to the correct mailbox server.

The open source NGNIX proxy is bundled as part of the zimbra-proxy package. This package can be installed on mailbox servers, MTA servers, or on their own independent proxy servers. When the zimbra-proxy package is installed, the proxy feature is enabled.

Zimbra Proxy Components

Zimbra Proxy includes the following:

Nginx. A high performance IMAP/POP3 proxy server which handles all incoming POP/IMAP requests.

Memcached. This is a high performance, distributed memory object caching system. Route information is cached for further use in order to increase performance. Memcached is contained in the zimbra-memcached package. There must be at least one memcached server installed for NGINX to function. It is not necessary for nginx and memcached to be on the same system, and you can have multiple nginx installations with only a single memcached installation.

Zimbra Proxy Route Lookup Handler. This is a servlet located on the ZCS mailbox server. This servlet handles queries for the user account route information (the server and port number where the user account resides). When the proxy server is configured, the service ports on backend Zimbra mailbox servers are changed to alternate ports. The proxy now services the standard ports for these protocols. This change is applied even if the proxy services are run on their own independent hosts, in order to distinguish and avoid confusion between the services.

Memcached is shipped as the caching layer to cache LDAP lookups. Memcached does not have authentication and security features so the servers should have a fill set up appropriately. The default port is 11211 and is controlled by zimbramemcacheBindPort conf setting in zimbraserver.

When the proxy server is configured, the service ports on backend Zimbra mailbox server are changed to alternate ports. The proxy now services the standard ports for these protocols. This change is applied even if the proxy services are run on their own independent hosts, in order to distinguish and avoid confusion between the services.

If you have any other services running on these ports, turn them off.

Zimbra IMAP/POP Proxy Server Port Mapping

	Port
Standard Ports served by Proxy
IMAP Proxy port	143
IMAP SSL proxy port	993
POP proxy port	110
POP SSL proxy port	995
Alternate Ports Served by Mailbox Servers
Route Lookup Handler	7072
IMAP server port	7143
IMAP SSL server port	7993
POP server port	7110
POP SSL server port	7995

When an IMAP or POP3 client logs in through the proxy, the following takes place:

The proxy analyzes the login sequence

Extracts the user name of the user trying to login

Does a HTTP lookup on a mailbox server to find out which server the mailbox of the user attempting to login lives on

This lookup service runs on mailbox servers on port 7072, and this port on mailbox servers should be available from all proxy servers.

Which mailbox servers participate in this lookup is determined by the zimbraReverseProxyLookupTarget server attribute on servers running the mailbox service. By default all mailbox servers participate in this lookup. Lookup is performed round-robin across configured mailbox servers. The result of the login name to mailbox server lookup are cached in memcached (an open source distributed in-memory hashtable). The memcached process is run alongside all IMAP/POP proxy services.

Note:

Memcached will be split into its own service in the future.