Package 1 · Backup MX
Secondary MX, temporary queuing during destination outages and automatic delivery on recovery. No mailbox pre-check, AntiSpam, Antivirus, content inspection or quarantine.
TECHNICAL GUIDES
SMTP service SMTP Relay and Smarthost Setup
Review SMTP service smarthost routing, SMTP AUTH, verified TLS and sender-domain scope for the SecuraWall SMTP Relay add-on.
Incoming and outgoing mail are separate
- Incoming routeBackup MX or Email Security
- Your mail serverExisting mailboxes remain here
- Outgoing routeOptional approved SMTP Relay
| Setting or decision | Review before applying |
|---|---|
| relayhost | [gate.securawall.com]:587 for a reviewed global route |
| smtp_sasl_auth_enable | yes |
| smtp_sasl_password_maps | Protected lookup; matching endpoint key |
| smtp_tls_security_level | verify; review CA trust and policy scope |
| Selective routing | Sender-dependent relay and credential maps |
| Keep incoming protection | Do not broaden mynetworks or incoming relay permissions |
Read-only configuration check
Run on your own mail server. These commands print selected settings, not passwords. They do not change configuration or submit mail.
postconf mail_version relayhost sender_dependent_relayhost_maps smtp_sender_dependent_authentication smtp_sasl_auth_enable smtp_tls_security_level
postconf -mPackage 2 · Email Security
Primary MX gateway with configurable AntiSpam, Antivirus, sender-domain checks and quarantine. Publish only gate.securawall.com and configure a separate manual receiving target. Queuing and recovery remain included.
Optional SMTP Relay add-on
Add authorized outbound delivery to either Package 1 or 2 for the same domain. Separate add-on pricing, approval, server credentials, quotas, TLS and verified SPF apply. Customer-domain DKIM signing is optional and recommended. Incoming protection remains determined by the base package.
Explore packages and add-ons
By the SecuraWall team · Updated · Operational guidance, not a delivery guarantee.
Define the authorized scope
Keep an active Backup MX or Email Security base and SMTP Relay add-on for each routed sender domain. Obtain sending approval and enabled SMTP device credentials. A global relayhost is a next hop, not a grant of domain rights. Inventory all sender domains and existing transport maps before changing it. Local delivery and explicit routes need separate review.
Configure the outgoing client
For port 587, use [gate.securawall.com]:587 with STARTTLS. Brackets suppress MX lookup. Enable SMTP SASL authentication and use a protected credential lookup with exactly the same bracketed destination and port. smtp_* settings control the client; smtpd_* settings control incoming connections. Enabling an outgoing smarthost does not require weakening incoming relay restrictions.
Verify the TLS peer
Require encryption, certificate validation and hostname matching with a working CA trust store. SMTP service supports smtp_tls_security_level = verify. Scope policy to the intended relay if other destinations need different policies. Encryption alone does not validate identity. Port 465 needs implicit TLS configuration; do not reuse this STARTTLS example unchanged.
Preserve existing configuration
The table is a review checklist, not a complete main.cf replacement. Select a lookup type supported by postconf -m and protect the credential file and generated database. Do not expose passwords in commands, tickets or screenshots. Review the distribution’s SASL packages and trust paths, validate with SMTP service check and perform a controlled reload. Carbonio-managed SMTP service requires its own persistent management procedure.
Route multiple domains deliberately
For selective routing, SMTP service provides sender_dependent_relayhost_maps and smtp_sender_dependent_authentication. Review unmatched-sender defaults and explicit transport overrides. Each relayed domain still needs current SecuraWall rights and account authorization; a shared server or credential does not supply them. Null-envelope delivery reports have no ordinary sender address and require separate routing review. Do not publish one global relay for three domains when only one is eligible.
Verify sender DNS
Apply the current account SPF suggestion to the existing single record before relay payment, keeping other legitimate senders. DKIM is optional and recommended. Preserve existing selectors and DMARC policy. Incoming base packages alone do not authorize outgoing relay. Using a relay does not remove a domain from a blacklist or guarantee inbox placement.
Test before broad deployment
Record the old settings and queue. Test one authorized sender and a controlled unauthorized sender. Compare local submission, SecuraWall authorization, remote SMTP acceptance and mailbox receipt separately. A temporary 4xx failure can remain queued; investigate permanent 5xx responses. Revert changed settings if required and review queued routing before retrying. This page does not claim a live deployment test.
References and service conditions
Related guides
Carbonio CE Email Security and SMTP Relay Setup
Plan incoming email security and optional authenticated SMTP Relay for Carbonio CE, including multi-domain routing limits.
Read guide →Set Up SMTP Relay
Configure approved device credentials and sender authentication.
Read guide →Deferred vs Bounced Email: SMTP 4xx and 5xx
Read delivery errors without confusing temporary retry, permanent rejection and inbox placement.
Read guide →