Backup MX Setup Guide

Before checkout

Use a reachable account email on a different domain from the protected domain. Enter the domain carefully: it cannot be renamed in the portal; changes require a support ticket. Keep an independent record of your original DNS settings.

1. Verify ownership

Copy the unique value shown in checkout into a DNS TXT record. Host / Name: _securawall-verify. TXT value: your exact securawall-verification=… token. In a DNS panel managing your domain, use the relative Host / Name shown, without duplicating the domain suffix. Keep the record published while using the service.

2. Add the secondary MX

Keep every legitimate primary MX record. Add an MX at the domain apex (usually Host / Name @) with target gate.securawall.com. Use a preference number higher than all intended primary MX records: for example, existing primary preferences 10 and 20 → backup preference 30. Lower numbers are preferred. SPF does not determine MX priority. Do not replace your primary MX or point delivery back to this gateway.

3. Choose delivery

Automatic: the service discovers eligible primary MX destinations, excludes this gateway and uses SMTP port 25. Primary MX preference orders delivery; a permanent recipient rejection is not treated as an outage to bypass.

Manual: enter the actual destination public IP or hostname and SMTP port. This is useful for a fixed inbound mail server. Delivery targets must pass safety checks; Delivery destinations must use validated public IPv4 addresses or, when IPv6 delivery is enabled, validated public IPv6 addresses.

Multiple primary MX records, including Google Workspace or Microsoft 365, do not mean multiple SecuraWall purchases. Use one domain plan and verify the discovered targets. Arrange any necessary receiving connector or trusted-forwarder configuration with your provider. Do not disable authentication checks globally.

4. Check before relying on it

Complete payment and DNS checks. Inspect the discovered targets, SMTP status and service dates. Package 1 uses the latest scheduled SMTP health result. If the scheduled health result shows that the primary server is available, Backup MX returns a temporary refusal and records it. When a recent scheduled result shows an outage, a bounded SMTP greeting check confirms that the primary server has not recovered before a new message is accepted. No mailbox lookup is performed. Missing or older-than-10-minute results temporarily defer. After installation or a destination change, wait for the next scheduled sample. Use a planned maintenance window to test outage acceptance, queuing and recovery delivery to a real recipient you control. An open SMTP port alone does not prove recipient acceptance.

If checks fail

Compare the exact TXT token against your authoritative DNS and the current order. Remove duplicate suffixes and stale tokens. Ensure the secondary MX has the correct target and priority. Ownership failures pause new acceptance and queued delivery. Invalid MX blocks new acceptance; automatic delivery also depends on valid primary MX discovery. Queued manual delivery may continue if ownership and destination remain valid. Pauses do not reset queue age. Check portal notices even if an alert email has not arrived.

Explore packages and add-ons

Related technical guidance

Queue, capacity and deletion conditions

Current plan: up to 14 days in the delivery queue; retries approximately every 3 minutes; maximum complete encoded message 50 MiB (52,428,800 bytes). Attachments grow when encoded. A domain may have a lower message limit.

No per-message charge or advertised message-count cap. Storage is finite and shared: there is no unlimited disk allocation or reserved per-domain capacity. Acceptance remains subject to available resources, active service and configured security policies.

A destination SMTP acceptance removes the message from the delivery queue; it does not prove delivery to an inbox. Temporary 4xx failures are retried within the remaining lifetime. Permanent 5xx failures normally end that delivery attempt with a failure notification. These notifications can themselves fail.

Undelivered mail expires after the configured lifetime, including time spent paused. Quarantined mail is removed at its retention deadline. Confirmed domain deletion permanently purges queued and held messages. If a queued message has recipients in multiple domains, deleting it removes it for every pending recipient. Delivered, expired or deleted messages are not a customer archive.

Read the service responsibilities

Ready to configure your domain?

Review the setup and conditions before purchasing.