I've been fortunate thus far ;) not to have to set up multiple instances. Now I'm on a job with a definite need for it: hosting company with domains which might possibly be moved to other providers without notice.
My solution to the problem was to completely separate submission (outbound, mostly) from MX mail. The MSA instance will look up each and every domain in DNS and will handle it as DNS says. It will not be tainted by any database lookups. The resolver in question isn't authoritative for any of the hosted domains. And the MSA instance listens on port 587 only, while the MX instance is on 25 only. The doubt in my mind about this is for mail truly destined to our hosted domains. It resolves to an Internet (not an internal) IP address which is in the MX instance's proxy_interfaces setting. We're in a DC and behind NAT, with that Internet IP address being NATed to this host. They don't have "hairpin NAT" set up, whereby if I try to connect to this NATed IP address it would go to the router and come back to me. I'm fine with that, actually; while that would solve the instant problem, it could be bad in other ways. The best I came up with: check_recipient_mx_access, where if the external name or IP is found, "REDIRECT smtp:[127.0.0.1]". Two issues with this: 1. Does not account for sendmail(1) submission 2. Redirects all recipients of multi-recipient mail #1 is unknown whether or not it is a problem. #2 is probably minor; I'll simply have the MX instance accept and relay them on. ISTM the only complete solution to this would be DNS views, giving my internal IP address for the external name. Does that cover it all? Is my reasoning valid; is there anything I missed? -- http://rob0.nodns4.us/ -- system administration and consulting Offlist GMX mail is seen only if "/dev/rob0" is in the Subject:
