DNS - to make mail servers find you

About MX entries

So now you have your working mail server. But how do emails find you? The answer lies in the most important service on the internet: DNS. Assume that you are the owner of the gmail.com domain. And a mail server somewhere on the other end of the internet wants to send an email to john@gmail.com. What the other mail server needs to do is find out which server on the internet it will have to establish an SMTP connection to in order to deliver the email. It does it by querying the DNS name server responsible for the "gmail.com" domain for an MX or alternatively an A record. MX stands for "mail exchanger" and is a set of records telling which mail server(s) to use. Let's run a query:

$> host -t MX gmail.com 
gmail.com mail is handled by 10 alt1.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 20 alt2.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 30 alt3.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 40 alt4.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 5 gmail-smtp-in.l.google.com
.

So as a result we get 5 different MX records. Each of them consists of a priority and the host name of the mail server. A mail server would pick the entry with the highest priority (=the lowest number) and establish an SMTP connection. In this example that would be the priority 5 server gmail-smtp-in.l.google.com. If that server could not be reached then the next best server with priority 10 would be used and so on. So all you have to do in your own DNS zone is add an MX entry pointing to your mail server. If you want to run a backup mail server (which is outside of the scope of this tutorial) then you can add a second entry with a lower priority.

A mistake some people make is using an IP address in MX records. That is not allowed. An MX record always points to a host name. You will have to add an A record to point to the actual IP address of your mail server.

(In the above example it is very unlikely that a mail server will ever have to use the server with priority 40. Adventurous system administrators can add such a low-priority entry and see who connects to it. Because an interesting fact is that spammers often try these servers first - hoping that it is just for backup purposes and less restrictive than the main server. If you see someone connecting to the lowest-priority address first without having tried a higher-priority mail server then you can be pretty certain that it's not a friend who's knocking at your door.)

Fallback to A entries

It's always best to explicitly name mail servers in the MX records. If you can't do that for whatever reason then the remote mail server will just do an A record lookup for the IP address and then send email there. If you just run one server for both the web service and the email service then you can do that. But if the web server for your domain is located at another IP address than your mail server then this won't work.

Dynamic DNS for your home mail server

What - you don't have a domain? No problem. With DynDNS you can get a server name on the internet for free. Get an account there, set up a hostname and make it point to your IP address. If you are on a dynamic IP address you can have your DNS record updated automatically by using programs like "ddclient" and still receive email on that server/domain name. You can even use an MX record that is different from the A record if you like. So there is no excuse for not having your own mail server at home.

10 Comments

554 554 5.7.1 <marcus@s5y.de>: Relay access denied (state 14)

Hello i tried many tutorials. But this ist the best tutorial for that topic.

I setup an E-mailserver on an vserver with an external domain (s5y.de)

After that tutorial i can send E-Mails from mutt to my e-mailaddress, but when i answer that mail i get this error-Mail back.

The DNS entry is

# host -t MX s5y.de
s5y.de mail is handled by 10 mail.s5y.de

Can you help my?

 

Marcus
 

I set it up at the DB

in the table virtual_domains ist

s5y.de

yrlist.de

in the main.cf is

# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

mydomain = mopple
myhostname = mopple.s5y.de


alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = $myhostname, localhost.s5y.de, localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
#mailbox_command = procmail -a "$EXTENSION"
mailbox_command = /usr/lib/dovecot/deliver
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf
virtual_transport = dovecot
 

I don't know what i have to do now

alternative to dyndns

Hi (great tutorial by the way!)

Just to point out that Dyndns seems to have discontinued their free dns services...

I found that freedns.afraid.org  is a great (and maybe the only remaining one?) free replacement.

DNS

Hi,
I can send emails from my mutt, but i can't recieve them.
During whole guide I was writing everywhere example.pl as a domain name.
In DNS settings (they are messed a little bit - i have bind here,  with ns1.xxx.pl. and ns2.xxx.pl. here - I know it is not good solution, but it works and I don't have to have 2nd server for dns somewhere)
so this is what I set there:
@ IN MX 10 mail.example.pl.
 
I know, there is probably error with mail. - i don't have that domain anywhere else - it is not existing for apache, or postfix.
 
Where can I add this to make it work? In postfix?
Or maybe I shall set this DNS record:
@ IN MX 10 example.pl. (without mail.)
I don't know what to do - I think this is only thing left to make it work.

 

MX-Record - how does it work?

Hi Christoph,

first of all, great Tutorial! Until this point, everything went like a charm. Thank you for having invested so much time.

What I'm unclear about now is what to enter as an MX-Record. I have my Domain hosted at strato.de, and pointed the A-Record to my fixed IP Address. So far, so good. Now when I want to add an MX-Record, I am forced to "Es muss ein absoluter Nameserver angegeben werden, d. h. der Servername muss mit einem Punkt nach der Topleveldomain enden." Is it correct to assume that if I had example.org as my domain and wanted my mail to be sent to and from mail.example.org, I just enter "mail." in that respective field?

Hope you can help.

Thanks in advance
Michael

PS: To all the non-german speakers, the quote vaguely translates to "You need to provide an absolute Nameserver, that is, the Servername needs to end with a fullstop after the Topleveldomain."

Just to make things clear...

...in case someone else stumbles upon the same problem (with strato, or another hoster):

The first mistake I made, was to think that if I entered "mail." in the MX-Record, it would automatically resolve to "mail.example.org". It doesn't. This would simply resolve to "mail", which is obviously not mine nor anyones receiving mail server.

The second mistake I made, was to enter "mail.example.org." in the MX-Record. This would resolve to "mail.example.org", and I foolishly assumed this was the right thing to do. Problem: I do not own the subdomain mail.example.org, it doesn't even exist. Result: Mails bounce back to the sender.

At the moment I am waiting for the DNS system to update to my current entry, namely simply "example.org.", my server address. If I had read and understood the section "Fallback to A entries" more thoroughly, I would have had 1 day less of sitting in front of my screen.

For all idiots like me out there: It is technically perfectly fine to have your mail server domain name be the same as your web domain name etc.

@Christoph: I am interested why you say it is best to explicitly name mail servers. Can you elaborate on that?

Best
Michael