About MX entries
So now you have your working mail server. But how do emails find you? The answer lies in the most important service on the internet: DNS. Assume that you are the owner of the gmail.com domain. And a mail server somewhere on the other end of the internet wants to send an email to john@gmail.com. What the other mail server needs to do is find out which server on the internet it will have to establish an SMTP connection to in order to deliver the email. It does it by querying the DNS name server responsible for the "gmail.com" domain for an MX or alternatively an A record. MX stands for "mail exchanger" and is a set of records telling which mail server(s) to use. Let's run a query:
$> host -t MX gmail.com
gmail.com mail is handled by 10 alt1.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 20 alt2.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 30 alt3.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 40 alt4.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 5 gmail-smtp-in.l.google.com.
So as a result we get 5 different MX records. Each of them consists of a priority and the host name of the mail server. A mail server would pick the entry with the highest priority (=the lowest number) and establish an SMTP connection. In this example that would be the priority 5 server gmail-smtp-in.l.google.com. If that server could not be reached then the next best server with priority 10 would be used and so on. So all you have to do in your own DNS zone is add an MX entry pointing to your mail server. If you want to run a backup mail server (which is outside of the scope of this tutorial) then you can add a second entry with a lower priority.
A mistake some people make is using an IP address in MX records. That is not allowed. An MX record always points to a host name. You will have to add an A record to point to the actual IP address of your mail server.
(In the above example it is very unlikely that a mail server will ever have to use the server with priority 40. Adventurous system administrators can add such a low-priority entry and see who connects to it. Because an interesting fact is that spammers often try these servers first - hoping that it is just for backup purposes and less restrictive than the main server. If you see someone connecting to the lowest-priority address first without having tried a higher-priority mail server then you can be pretty certain that it's not a friend who's knocking at your door.)
Fallback to A entries
It's always best to explicitly name mail servers in the MX records. If you can't do that for whatever reason then the remote mail server will just do an A record lookup for the IP address and then send email there. If you just run one server for both the web service and the email service then you can do that. But if the web server for your domain is located at another IP address than your mail server then this won't work.
Dynamic DNS for your home mail server
What - you don't have a domain? No problem. With DynDNS you can get a server name on the internet for free. Get an account there, set up a hostname and make it point to your IP address. If you are on a dynamic IP address you can have your DNS record updated automatically by using programs like "ddclient" and still receive email on that server/domain name. You can even use an MX record that is different from the A record if you like. So there is no excuse for not having your own mail server at home.
10 Comments
554 554 5.7.1 <marcus@s5y.de>: Relay access denied (state 14)
Submitted by Anonymous (not verified) on
Hello i tried many tutorials. But this ist the best tutorial for that topic.
I setup an E-mailserver on an vserver with an external domain (s5y.de)
After that tutorial i can send E-Mails from mutt to my e-mailaddress, but when i answer that mail i get this error-Mail back.
The DNS entry is
# host -t MX s5y.de
s5y.de mail is handled by 10 mail.s5y.de
Can you help my?
Marcus
Apparently the mail server at
Submitted by Christoph Haas on
Apparently the mail server at mail.s5y.de is not feeling responsible for that domain. If that's a Postfix then you probably did not set up the domain there properly (as a local or virtual domain).
I set it up at the DB
Submitted by Anonymous (not verified) on
in the table virtual_domains ist
s5y.de
yrlist.de
in the main.cf is
# See /usr/share/postfix/main.cf.dist for a commented, more complete version
# Debian specific: Specifying a file name will cause the first
# line of that file to be used as the name. The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h
readme_directory = no
# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.
mydomain = mopple
myhostname = mopple.s5y.de
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = $myhostname, localhost.s5y.de, localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
#mailbox_command = procmail -a "$EXTENSION"
mailbox_command = /usr/lib/dovecot/deliver
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf
virtual_transport = dovecot
I don't know what i have to do now
alternative to dyndns
Submitted by Anonymous (not verified) on
Hi (great tutorial by the way!)
Just to point out that Dyndns seems to have discontinued their free dns services...
I found that freedns.afraid.org is a great (and maybe the only remaining one?) free replacement.
DNS
Submitted by Anonymous (not verified) on
MX-Record - how does it work?
Submitted by Michael (not verified) on
Hi Christoph,
first of all, great Tutorial! Until this point, everything went like a charm. Thank you for having invested so much time.
What I'm unclear about now is what to enter as an MX-Record. I have my Domain hosted at strato.de, and pointed the A-Record to my fixed IP Address. So far, so good. Now when I want to add an MX-Record, I am forced to "Es muss ein absoluter Nameserver angegeben werden, d. h. der Servername muss mit einem Punkt nach der Topleveldomain enden." Is it correct to assume that if I had example.org as my domain and wanted my mail to be sent to and from mail.example.org, I just enter "mail." in that respective field?
Hope you can help.
Thanks in advance
Michael
PS: To all the non-german speakers, the quote vaguely translates to "You need to provide an absolute Nameserver, that is, the Servername needs to end with a fullstop after the Topleveldomain."
Thanks for the feedback. Good
Submitted by Christoph Haas on
Thanks for the feedback. Good to hear the setup worked for you so far.
Regarding DNS: there are too notations. If you don't have a dot at the end "mail" then the respective domain name is added. Say your domain is "example.org" and you enter "mail" then the actual name gets "mail.example.org". But if you add a dot then you tell that your entry is already fully-qualified. So "mail." wouldn't work because there is no top-level domain "mail" in the world. Apparently Strato expects a fully-qualified name like "mail.example.org." - try that.
Exactly. Thanks.
Submitted by Michael (not verified) on
Exactly that was what they wanted to see. Thank you!
Just to make things clear...
Submitted by Michael (not verified) on
...in case someone else stumbles upon the same problem (with strato, or another hoster):
The first mistake I made, was to think that if I entered "mail." in the MX-Record, it would automatically resolve to "mail.example.org". It doesn't. This would simply resolve to "mail", which is obviously not mine nor anyones receiving mail server.
The second mistake I made, was to enter "mail.example.org." in the MX-Record. This would resolve to "mail.example.org", and I foolishly assumed this was the right thing to do. Problem: I do not own the subdomain mail.example.org, it doesn't even exist. Result: Mails bounce back to the sender.
At the moment I am waiting for the DNS system to update to my current entry, namely simply "example.org.", my server address. If I had read and understood the section "Fallback to A entries" more thoroughly, I would have had 1 day less of sitting in front of my screen.
For all idiots like me out there: It is technically perfectly fine to have your mail server domain name be the same as your web domain name etc.
@Christoph: I am interested why you say it is best to explicitly name mail servers. Can you elaborate on that?
Best
Michael
Nice DNS odyssey. :)
Submitted by Christoph Haas on
Nice DNS odyssey. :)
You ask why I use explicit MX records. The reason is simply that if I move the web server somewhere else I don't necessarily move the mail server, too. Same reason I use smtp.workaround.org, pop3.workaround.org and imap.workaround.org for my users. Because if one day I just want to move the SMTP service I couldn't do that if I weren't using seperate DNS names.
Most of the time you may think of using different DNS names for your internet services as a burden and waste of time. But then there comes a time in every sysadmin's life where you need exactly that and figure out that 10,000 users would have to change their email settings on all of their computers and you're screwed without it.