Global mail A record

george

Hello,
I think it will be great to have something like global mail subdomain like mail.panel.com
It gives extra value and flexibility to the cluster.
For the moment, we can use mail.server.com or mail.example.com (the second one, for the moment, do not have a valid SSL certificate)

Thank you all!

Adam

Are you talking about a load balancer or proxy which would run on a central server and distribute the request to the correct mail server for that website?

george

Adam Hello Adam, I am talking about a proxy running on a central server and distributing the request to the correct mail server for that website.

necrom

george I've done similar in the past using haraka.github.io and haproxy, just need to build a domain:backend map via the API for it to reference

Adam

The risk is that your load balancer receives a DDoS or is otherwise taken offline, all of your customers will lose access.

It's a potential future Enhance feature if enough customers want it.

necrom

Adam Assuming it's only used to balance incoming connects (so as to not run into SPF length/recursion issues) you could theoretically have more proxies than you have mail servers / spread it far and wide for anti-DDoS operations. The DDoS would also likely be taking down the proxy before the mail service, so mail clients would stop working but outbound website emails might still get out. Not a priority for us, but it'd certainly make support easier.

ss88us

I understand the concept. Is it possible for the proxy layer to cache requests and still serve them even if it's offline (like browser cache)? The 'pointing' would rarely change.

Also if this get's integrated, I would suggest also having autodiscover set-up too.

necrom

ss88us The domain:mx can be cached at the proxy, but the proxy must be online to proxy the front to back, there's not really any way to selectively return the correct backend DNS for the users domain (like geodns balancing) and mail client DNS caching is very inconsistent anyway.

ss88us

necrom Got it! So it might be better to put the proxied domain through Cloudflare in an attempt to mitigate attacks but I'm not sure if that'll work as expected. Could be worth a try.

necrom

ss88us iirc cloudflare doesn't do POP3 and IMAP proxy, only SMTP routing/proxying. I've never had issues where mail service is DoS purposefully, the only benefits of the proxy are seamless mail server migrations and simplifying support. You do get the eggs in one basket problem as Adam highlighted but there's no reason you couldn't run 2 or more proxies with one or multiple DNS A records and/or on DDoS mitigated network.