Re: [gentoo-user] inhouse email

[Marshal Newrock]

On Monday 24 October 2005 11:36, John Jolet wrote:
> Two things, well several things, really.  You need more than one mail
> server, or you need a store-and-forward mx in case your mail server goes
> down. Second, I'd make sure you put antivirus and spam guards on the mail
> server, and that it's beefy enough to handle the traffic.  A good split
> is to put a bastion mail server doing antivirus and spam checks, but no
> user verification outside the firewall (or inside a non-natting
> firewall), and have him just forward everything to a secure mail server
> inside.  put the secure mail server with a non-routable ip, and the
> bastion mail server with one public ip, and one non-routable, to talk to
> the secure mail server.  Make sure both mail servers are up-to-date and
> kept up to date patchwise.  Run NO other services (except maybe ssh) on
> either server.

I'd like to disagree with a couple points on here.

First off, a secondary MX is not necessary.  If an email can't get through 
due to a server being down, it will be retried and get through later when 
the server is up.

Second, if you are receiving email from the outside world and are not doing 
any user verification, you are a source of backscatter, and therefore of 
spam.  Do not accept mail for invalid receipients.  Do not have a secondary 
MX if you can not do recipient verification with it.  Accept-and-bounce is 
spam.

Depending on the amount of mail received, it's not necessary to separate 
services to different boxes.  Sending and receiving mail takes very little 
resources.  It's the extra services, such as spam and antivirus, that 
require heavier hardware, again depending on your load.  You do want to 
make sure, though, that no outside connections are possible to any spam or 
virus filtering programs on the mail server.

-- 
gentoo-user@g.o mailing list