SECURAWALL MAILFLOW
Connect your email platform
Keep your existing mailboxes. Configure the incoming route for your base package, verify delivery and add SMTP Relay if you need outgoing email.
Backup MX
- Keep your legitimate primary MX records. Add gate.securawall.com with a higher MX preference number than all your primary MX records.
- Publish and retain the ownership TXT token. Check the discovered or manual receiving destination.
- Test a clean message and controlled outage/recovery. This package queues and forwards without content scanning or pre-acceptance mailbox lookup.
Email Protection
- Save and verify the actual public receiving hostname/IP and SMTP port as a manual target before changing MX.
- Publish only gate.securawall.com as the domain MX. Review antispam, antivirus and quarantine settings.
- Test known and missing recipients, message delivery and quarantine. Plan direct-delivery restrictions without affecting other domains sharing your receiving server.
SMTP Relay
- Keep Backup MX or Email Protection active for the same domain and purchase the optional SMTP Relay add-on. Obtain sending approval and create an enabled SMTP device authorized for the domain.
- Configure STARTTLS on 587 or TLS on 465. Add the sending IP to the existing SPF record, not a second SPF record.
- DKIM signing is optional and recommended. If you choose it, create domain DKIM, publish the exact TXT record and activate after verification. Confirm SPF, DKIM, DMARC and actual receipt at a mailbox you control.
Platform-specific setup
Choose the receiving platform below. Save original DNS and connector settings before changes, and verify the intended route before restricting other sources.
Google Workspace
- Save the actual Google delivery endpoint before changing MX.
- In Google Admin, configure Gmail → Spam, phishing and malware → Inbound gateway using the gateway source IP.
- Apply Reject all mail not from gateway IPs only after reviewing the affected organizational scope. Do not apply this globally to Backup MX; its primary delivery route must remain available.
- Routing all Gmail outbound mail is a separate connector integration; it is not the same as configuring an SMTP AUTH device.
Microsoft 365
- Save the tenant delivery endpoint; do not discover it from the protected domain’s new MX.
- Review Exchange admin center → Mail flow → Connectors for partner source-IP and TLS restrictions.
- Check hybrid flows, source-IP attribution and other domains before applying tenant-wide restrictions. Validate known and missing recipients.
Microsoft Exchange
- Identify the actual SMTP endpoint and certificate name.
- Plan Receive connector bindings, ports and allowed remote IP ranges. Keep protected inbound mail separate from client submission and internal relay.
- If NAT changes the source, use the address actually seen by the receiving server. Do not create an anonymous internet relay.
Carbonio / Zimbra / Linux SMTP
- Save the public SMTP destination and port. An intermediate firewall/MTA must pass recipient verification to the actual mailbox server.
- Check that a known recipient returns 250 and a definitively missing recipient returns 550. A temporary outage must not be treated as a missing user.
- Use the platform-managed relay and authentication settings for the installed version. Avoid direct edits to configuration files regenerated by the platform.