This article applies to:
- Trustwave MailMarshal (SEG)
Question:
- How does MailMarshal determine where to deliver email?
- How does MailMarshal use DNS to resolve IP addresses for mail delivery?
Information:
Step 1 - Special Cases
MailMarshal first checks to see if any rules have applied specific Routing Rules to the message. Routing Rules use the Engine rule action "Set message routing to host". If such an action was applied to the message at the Engine, then the Sender service will route the message to the host listed. This overrides all the other delivery options described below.
Note: Prior to version 6.4, the Local Domains are evaluated before routing rules.
Step 2 - Specific Domains
MailMarshal checks the active Routing Table for any rules affecting the specific domain being delivered. You can make Routing Table entries for individual domains or patterns. See the Routes item in the user interface. You can include multiple entries for balanced or failover delivery using weighting similar to MX record weighting. You can also set a different Routing Table for each processing server if required.
Step 3 - Inbound Email
MailMarshal next checks to see if the domain part of the message is listed in the MailMarshal Local Domains, accessed through the Local Domains item in the Configurator or Management Console. Email for Local Domains is routed based on the Local Domains entry in the active Routing Table. This entry allows multiple destinations using weighting similar to MX record weighting. Inbound email is defined as email addressed to any domain listed in Local Domains.
Step 4 - Outbound Email
If there is no match in any of the above steps then MailMarshal will attempt to deliver based on the Default Route in the Routing Table. Outbound email is defined as any email addressed to a domain not listed in Local Domains. A default entry is created when MailMarshal is installed (either DNS delivery or forwarding to another server). You can specify one or more forwarding hosts using priority to set failover or balancing.
If you have configured MailMarshal to deliver email itself using DNS resolution then the domain name resolution steps are as follows:
- Take the domain part of the email address.
- Perform a MX look up on that domain.
- If there is no MX record, do an A lookup on the domain name. If the A lookup returns an IP address, attempt to deliver to that address.
- Note that if there is no MX record and the A lookup returns a CNAME, MailMarshal will NOT attempt delivery.
- If there are any MX records, try each MX record in order of preference/cost.
- For each MX record, MailMarshal performs an A record lookup on the MX record's Fully Qualified Domain Name (FQDN).
- If that A lookup fails, it will try a CNAME lookup on the FQDN.
- For each IP address returned in the A record or CNAME lookup:
- It will try to connect.
- If unable to connect, it tries the next MX record.
- If connected and successful, send mail.
- If connected and it gets a permanent failure - STOP.
- If connected and it gets a temporary failure - try next MX record.
If the Sender connects to any host and gets a 500 error (permanent failure), MailMarshal stops and does not try any of the other MX records at all. If it gets a temporary failure, it will go on with the next MX record. This is done because, if a higher preference MX refuses to accept mail from MailMarshal, it assumes that the lower preference MX will also refuse it. If MailMarshal gets a temporary failure (such as out of disk space) it will attempt the next MX.
Important Note: MailMarshal will use only the DNS servers listed in the Configurator - it does not use the DNS servers defined for the operating system.
Notes:
The most important change to email routing in MailMarshal over time is the introduction of routing tables in MailMarshal 6.4 and above, which adds significant flexibility in delivery options.
Further Reading: RFC974 - MAIL ROUTING AND THE DOMAIN SYSTEM
- This article was previously published as:
- NETIQKB45313