-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We should be able to do split DNS. I'll work on it. Ken Brian Sebby wrote:
MCS is now behind the Ironport systems, and the MX record that the lab-wide mailrelay systems see is mailgateway.anl.gov and mailgateway-bak.anl.gov. We suppress the MX lookups to avoid the mail loop that would be caused when mail gets delivered to mailrelay.anl.gov and mailrelay-bak.anl.gov after it hits the Ironport systems (mailgateway*). We avoid this for most of our lab systems by having a split DNS; the mailrelay servers see our internal DNS view, so once external mail comes in to the mailgateway servers and is passed off to mailrelay, they then deliver mail to the proper MX host using the internal records.
If MCS set up a split DNS that we could use, that would simply mail delivery greatly.
Brian
On Thu, Jun 10, 2010 at 10:30:39AM -0500, Max trefonides wrote:
My understanding is that setting the relay to a dns round-robin address is fine, although preventing the mtu from doing mx lookups would make delivery fail if dns happened to point mailgateway to newman for and newman was down. Shouldn't we just have two mx records set for mcs.anl.gov? one for newman and one for mailrelay-bak?
curious: why are we suppressing mx lookups for mailrelay? curious, I thought this was used more to keep mail loops from happening when the MTA pointed to an MX living on the same IP ...
-- max
On Jun 9, 2010, at 5:57 PM, Brian Sebby wrote:
Right now, the transport map is set to go to [mailrelay.mcs.anl.gov]. The [] prevents it from doing MX lookups, but I'm not sure how it handles it if the A record resolves to multiple places. I can help do some testing if you'd like.
One thing that might help (maybe) is the smtp_fallback_relay parameter that specifies a fallback relay for an instance in master.cf. We could possibly set up some sort of MCS-specific transport with a fallback relay, but I don't know if that would work properly or not. We're using the fallback relay on the pager servers to force it to rate limit, but it's pretty kludgy.
Brian
On Wed, Jun 09, 2010 at 05:27:43PM -0500, Craig Stacey wrote:
My reading of postfix configs and such tell me that we can't have multiple entries in /etc/postfix/transport for the same rules. One solution I see presented is to have a hostname that resolves to both. Since mailrelay.mcs.anl.gov is a CNAME on newman, we could instead make it an A record to point to both newman and mailrelay-bak.
On Jun 9, 2010, at 3:15 PM, Kenneth Raffenetti wrote:
Brian,
I've configured a backup mailrelay machine for MCS mail. Could you add mailrelay-bak.mcs.anl.gov to your configs any place newman.mcs.anl.gov exists?
Thanks, Ken
== Craig -- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkwRK3cACgkQvRJB9CBtvwjYvACfd5z+wkRI895GKvxmu3SkRLwy AKEAoLedVTfY+G1QH8Euq1KJoV4yrLsR =w5IU -----END PGP SIGNATURE-----