There is a newer issue of thie ISPmail guide available if you are using Debian Jessie!
About MX entries
So now you have your working mail server. But how do emails find you? The answer lies in the most important service on the internet: DNS. Assume that you are the owner of the gmail.com domain. And a mail server somewhere on the other end of the internet wants to send an email to john@gmail.com. What the other mail server needs to do is find out which server on the internet it will have to establish an SMTP connection to in order to deliver the email. It does it by querying the DNS name server responsible for the “gmail.com” domain for an MX or alternatively an A record. MX stands for “mail exchanger” and is a set of records telling which mail server(s) to use. Let’s run a query:
$> host -t MX gmail.com
gmail.com mail is handled by 10 alt1.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 20 alt2.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 30 alt3.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 40 alt4.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 5 gmail-smtp-in.l.google.com.
So as a result we get 5 different MX records. Each of them consists of a priority and the host name of the mail server. A mail server would pick the entry with the highest priority (=the lowest number) and establish an SMTP connection. In this example that would be the priority 5 server gmail-smtp-in.l.google.com. If that server could not be reached then the next best server with priority 10 would be used and so on. So all you have to do in your own DNS zone is add an MX entry pointing to your mail server. If you want to run a backup mail server (which is outside of the scope of this tutorial) then you can add a second entry with a lower priority.
A mistake some people make is using an IP address in MX records. That is not allowed. An MX record always points to a host name. You will have to add an A record to point to the actual IP address of your mail server.
(In the above example it is very unlikely that a mail server will ever have to use the server with priority 40. Adventurous system administrators can add such a low-priority entry and see who connects to it. Because an interesting fact is that spammers often try these servers first – hoping that it is just for backup purposes and less restrictive than the main server. If you see someone connecting to the lowest-priority address first without having tried a higher-priority mail server then you can be pretty certain that it’s not a friend who’s knocking at your door.)
Fallback to A entries
It’s always best to explicitly name mail servers in the MX records. If you can’t do that for whatever reason then the remote mail server will just do an A record lookup for the IP address and then send email there. If you just run one server for both the web service and the email service then you can do that. But if the web server for your domain is located at another IP address than your mail server then this won’t work.
Dynamic DNS for your home mail server
What – you don’t have a domain? No problem. With dynamic name services you can get a server name on the internet – often even for free. DynDNS was a good free choice in the past but they went to a commercial model – so if you don’t want to spend any money they are out of question. However there are several free services nowadays that you can use like no-ip. Get an account there, set up a hostname and make it point to your IP address. If you are on a dynamic IP address you can have your DNS record updated automatically by using programs like “inadyn” and still receive email on that server/domain name. You can even use an MX record that is different from the A record if you like. So there is no excuse for not having your own mail server at home.
However you should check if your internet service provider allows you to speak SMTP. Some ISPs block TCP port 25 because they think it’s a good way to block spammers. In that case you may need to ask them how to relay email to the internet.
Hey Cristoph,
thank you very much for this very elaborate and comprehensible guide.
I’d like to ask you how one would go on about having a back-up mail server in case of a failure/downtime of the mail server.
Does one simply need to run the same setup as on the primary mail server with a lower MX priority?
If yes, do you know how it’d be possible to synchronize the two servers?
Take a look at http://www.postfix.org/STANDARD_CONFIGURATION_README.html#backup , it appears like you are not completely sure how back-up mail servers work.
After setting up the secondary server, you might want to repeat necessary steps to modify your Postfix installation like you did with your first.
Maybe add a note to the guide?
Hi Christoph
Thanks for this awesome tutorial it has been very helpful.
A question about how MX records are setup for the virtual domains and how users of the virtual domains would configure their clients.
If everything has been setup on the one server. So lets call it “example01.org”
It has an “A” record for “example01.org”,
an MX record for “example01.org” which points to “mail.example01.org” and then
an “A” record for “mail.example01.org” which is the same IP address for “example01.org”.
The PTR record for the IP address for “example01.org” points back to “mail.example01.org”.
Now when setting up DNS records for the virtual domains (for this example lets call the virtual domain “example05.org”), is it OK to have
the “MX” record for “example05.org” point to “mail.example01.org” and then
“mail.example05.org” is a “CNAME” record that points to “example01.org”
Then when a user of the virutal domain configures their email client to use server “mail.example05.org”, and they then send email somewhere else, would the remote server accept the forward and reverse DNS looks for “mail.example05.org”
Thanks
James
Hi I do hope you can help me out, I have a website https://lioville.ddns.net and I tried to setup postfix on the same webserver. I am using NOIP for my domain name.
And when I do mx lookup on mxtoolbox it will show {No A record} for my IP address. I am unable to enter any IP address when I am creating a MX record in NOIP.
How do I fix this?
Thanks
It appears that you indeed have an MX entry:
$ dig +short lioville.ddns.net mx
1 lioville.ddns.net.
Mail servers found for domain:
– alt4.gmail-smtp-in.l.google.com (priority 40, ip address: 64.233.168.26)
– alt1.gmail-smtp-in.l.google.com (priority 10, ip address: 74.125.24.27)
– alt2.gmail-smtp-in.l.google.com (priority 20, ip address: 64.233.187.26)
– gmail-smtp-in.l.google.com (priority 5, ip address: 108.177.119.27)
– alt3.gmail-smtp-in.l.google.com (priority 30, ip address: 74.125.28.26)
Using mail server with lowest priority number:
– gmail-smtp-in.l.google.com (priority 5, ip address: 108.177.119.27)
Server doesn’t allow e-mail address verification
Mail servers found for domain:
– alt4.gmail-smtp-in.l.google.com (priority 40, ip address: 64.233.168.26)
– alt1.gmail-smtp-in.l.google.com (priority 10, ip address: 74.125.24.27)
– alt2.gmail-smtp-in.l.google.com (priority 20, ip address: 64.233.187.26)
– gmail-smtp-in.l.google.com (priority 5, ip address: 108.177.119.27)
– alt3.gmail-smtp-in.l.google.com (priority 30, ip address: 74.125.28.26)
Using mail server with lowest priority number:
– gmail-smtp-in.l.google.com (priority 5, ip address: 108.177.119.27)
Server doesn’t allow e-mail address verification
Like it
Love it
Reporting-MTA: dns; googlemail.com
Received-From-MTA: dns; bhujelbishal054@gmail.com
Arrival-Date: Fri, 30 Nov 2018 22:44:33 -0800 (PST)
X-Original-Message-ID:
Final-Recipient: rfc822; hr@awayjob.com
Action: failed
Status: 5.0.0
Remote-MTA: dns; smx1.web-hosting.com. (162.255.118.61, the server for the
domain awayjob.com.)
Diagnostic-Code: smtp; 550 High probability of spam
Last-Attempt-Date: Fri, 30 Nov 2018 22:44:40 -0800 (PST)