Forum Discussion

Terry_Rodecker_'s avatar
Terry_Rodecker_
Icon for Nimbostratus rankNimbostratus
Sep 22, 2016

GTM, WideIPs, and MX Records

We've been using GTM successfully for a couple of years to load balance simple web sites across multiple data centers. Our appliances are actually combination LTM/GTM appliances as we use the LTM portion to load balance across multiple ISPs within each data center. In short, we can switch between ISPs within a datacenter or change datacenters simply by changing the order of the members of the GTM pool. We'd like to move our MX records (external SMTP connectivity basically) to the wonderful world of GTM and I'm needing some assistance in getting that setup.

 

For inbound, I'm pretty sure we can simply take the design we have in place for our websites and just populate the pools with entries for the SMTP servers rather than web servers. It's the outbound that I'm concerned about. In short, we have 4 total SMTP gateways spread across two data centers (two in each data center). One data center has three ISPs that we load balance across and the other data center has two ISPs that we load balance. Work the numbers and that means we have 10 total public IP Addresses that could be presented to the outside world when we send email from our SMTP appliances. My question is, how do I get those 10 potential public IP addresses to coincide with the MX record(s) so if someone else were to do a reverse lookup for our MX record, they'd get a match regardless of what IP address was presented?

 

Currently, we have an SMTP forwarder VS that has a wildcard as the destination and uses a SNAT pool that will SNAT the source IP address to one that matches our MX record. I'm guessing we'd still need to keep the SMTP forwarder and SNAT pools in place but would need to expand them a bit to include the other IP Addresses.

 

Any and all information is greatly appreciated. Thanks!

 

1 Reply

  • I don't think the MX records for your incoming SMTP servers have to match the IP-addresses that are used for systems that are sending mail. It's true that most SMTP servers will do a reverse lookup for systems that try to deliver them mail as one of the many checks to prevent accepting mail from a malicious source, but it has nothing to do with the MX records. These are only used for incoming mail.

     

    Also check your SPF records if you are using them. Make sure these are matching the servers that are known to send mail for your domain.