Quote:
Originally Posted by pgienger  If you've ever set up a 'regular' backup MX, it doesn't require any special consideration for users. I would imagine that it just sends back a non-existant user message to mail from: address given in the SMTP conversation.
Think about it this way: if you're forced to use it, your ISP's customer facing smtp server accepts mail from you for any domain, it doesn't know your recipient exists, but it still accepts it, just as any mail relay listed in your headers did. In a non open-relay you either say who you're going to accept mail from (host wise), or who you're going to accept mail to (on a domain level), and it lets the endpoint figure out the validity. It also has to work this way in case your host isn't available for authentication and mail sits in some halfway queue for a while.
The only real reason I asked is just in case there was any configuration in the ZCS suite that would deny it from being a relay in the 'traditional' manner, and I didn't have time to go digging through the configs for any obscure parameter  |
I know alot of people set up backup MX hosts this way, but we never set up backup MX servers to do "store and forward" for whole domains because of the backscatter between the two servers.
Consider: Spammer sends an email directly to the backup MX to a non-existent user. The backup MX accepts the email and then tries to send it to the primary MX.
The primary MX does a recipient check and rejects the email, sending the backup MX a bounce notice.
The backup MX now tries to contact the original sender (not likely) with its own bounce message.
Worse, if the spammer forged the sender as, say, "postmaster" on the recipient domain, then the backup MX bounce message will be sent to the primary MX.
The end result is you have greatly increased the traffic on your servers needlessly, when all you had to do was not accept the spam in the first place--by doing recipient verification on the backup MX.
We build non-Zimbra Postfix gateway boxes for Exchange servers to do email pre-filtering and backup services, and sometimes act as an Exchange SmartHost so the Exchange box never gets a public IP, let alone an MX record.
On the Postfix box, we run a script that does an LDAP lookup in Active Directory and then extracts all of the valid email addresses. The script then rebuilds the relay_recipients table on the fly with this info and refreshes Postfix.
I imagine your backup box could run a similar script against the Zimbra box as well.
Here's the Postfix doc on backscatter:
Postfix Backscatter Howto
The Active Directory LDAP lookup script is from The Book of Postfix (No Starch Press), by Hildebrandt and Koetter.
Hope that helps,
Mark