Package 1 · Backup MX
Secondary MX, temporary queuing during destination outages and automatic delivery on recovery. No mailbox pre-check, AntiSpam, Antivirus, content inspection or quarantine.
TECHNICAL GUIDES
Carbonio CE Email Security and SMTP Relay Setup
Plan incoming email security and optional authenticated SMTP Relay for Carbonio CE, including multi-domain routing limits.
Incoming and outgoing mail are separate
- Incoming routeBackup MX or Email Security
- Your mail serverExisting mailboxes remain here
- Outgoing routeOptional approved SMTP Relay
| Setting or decision | Review before applying |
|---|---|
| Menu | MTA → Outbound Flow → Relay Host |
| Scope | All configured Carbonio domains |
| Endpoint | gate.securawall.com |
| Ports | 587 / STARTTLS or 465 / implicit TLS |
| Credentials | Approved SMTP device; configure authentication separately |
| Rights | Active base + relay add-on and account authorization per domain |
Read-only configuration check
Run on your own mail server. These commands print selected settings, not passwords. They do not change configuration or submit mail.
sudo -iu zextras /opt/zextras/common/sbin/postconf mail_version relayhost sender_dependent_relayhost_maps smtp_sender_dependent_authentication smtp_sasl_auth_enable smtp_tls_security_levelPackage 2 · Email Security
Primary MX gateway with configurable AntiSpam, Antivirus, sender-domain checks and quarantine. Publish only gate.securawall.com and configure a separate manual receiving target. Queuing and recovery remain included.
Optional SMTP Relay add-on
Add authorized outbound delivery to either Package 1 or 2 for the same domain. Separate add-on pricing, approval, server credentials, quotas, TLS and verified SPF apply. Customer-domain DKIM signing is optional and recommended. Incoming protection remains determined by the base package.
Explore packages and add-ons
By the SecuraWall team · Updated · Operational guidance, not a delivery guarantee.
Choose the direction first
Backup MX keeps your existing primary MX and adds a less-preferred secondary route for temporary queuing without incoming inspection. Email Security uses SecuraWall as the only published MX and delivers inspected mail to your real Carbonio receiving host and port. SMTP Relay sends eligible outgoing mail through SecuraWall; it is an optional add-on to either base package for the same domain. Your mailboxes remain on Carbonio.
Prepare the incoming route
Verify ownership and save the real public receiving destination before changing MX. It must resolve to Carbonio or its receiving firewall, not back to SecuraWall. For Email Security, restrict direct receiving traffic appropriately to prevent gateway bypass while preserving recipient validation. Test forwarding authentication. For Backup MX, test standby behavior and queuing during a controlled outage. Neither service creates Carbonio accounts or synchronizes quarantine users.
Find the Carbonio setting
Open Carbonio CE Admin Panel → MTA → Outbound Flow → Relay Host. The vendor documents this as a global route affecting all configured domains. This field selects a destination; it does not provide per-domain credentials. Record the original value before changing it. Follow the configuration application procedure for your installed release.
Configure authentication separately
Use gate.securawall.com with STARTTLS on 587 or implicit TLS on 465, plus approved SMTP device credentials. Filling Relay Host alone does not configure SMTP AUTH, mandatory TLS or certificate verification. Review the effective configuration below and use a vendor-supported persistent configuration method for your release. This guide does not claim a complete username/password workflow exists in the Carbonio CE web interface. A hostname, shared public IP or reverse DNS record grants no relay rights.
Review every sender domain
Example: one Carbonio server hosts three domains but only one has a relay add-on. A global relay also routes the other domains to SecuraWall; their rights do not follow the hostname. Each domain using this route needs its own active base package, relay entitlement and account authorization. Otherwise, arrange selective sender routing supported by your Carbonio release. SMTP service features alone do not prove a persistent Carbonio configuration. Do not send an unrelated domain under another domain’s credentials.
Check SPF and optional DKIM
Use the current SPF suggestion in your SecuraWall account before relay payment, preserving other legitimate senders in the existing single SPF record. Do not create a second record. DKIM signing is optional and recommended; preserve selectors and review DMARC alignment. An incoming-only base package does not itself require adding SecuraWall as an outbound sender.
Test and retain a rollback path
Send one controlled message to a mailbox you own. Compare Carbonio and SecuraWall queue IDs, remote response and actual receipt. Repeat for each intended domain and confirm unauthorized senders are refused. Login or submission success does not prove delivery. Restore the original route if the test fails; avoid repeated submissions or flushing an entire queue. This is configuration guidance, not certification or a claim that your Carbonio release has passed an end-to-end test.
References and service conditions
Related guides
SMTP service SMTP Relay and Smarthost Setup
Review SMTP service smarthost routing, SMTP AUTH, verified TLS and sender-domain scope for the SecuraWall SMTP Relay add-on.
Read guide →Set Up SMTP Relay
Configure approved device credentials and sender authentication.
Read guide →How to Test Backup MX Safely
Validate your own domain, queue behavior and recovery without treating an open port as successful delivery.
Read guide →