SECURAWALL MAILFLOW
Deployment & operations guide
Prepare, connect, verify, recover and roll back your email gateway.
Before changing DNS
- Keep a copy of current MX, TXT, receiving-connector, firewall and certificate settings.
- Identify the real public receiving hostname, SMTP port and certificate name. Never route the destination back to the protected domain MX.
- Use Backup MX as a secondary route or Email Protection as your only published MX. SMTP Relay is an optional outbound add-on and does not change your incoming MX setup.
- Keep an independent recovery address and an agreed maintenance/rollback contact.
| Package | Connection | Required validation |
|---|---|---|
| Backup MX | Keep legitimate primary MX; add less-preferred gateway MX | Ownership TXT; actual gateway delivery; controlled outage/deferred queue and recovery. No mailbox probe or content protection. |
| Email Protection | Save manual real destination, then publish only gate.securawall.com as MX | Known/missing recipient; clean delivery; authorized malware test; quarantine, digest and release; direct-delivery bypass restrictions. |
| SMTP Relay | Keep Package 1 or Package 2 active for the same domain; obtain sending approval and authorized device credentials; use STARTTLS on port 587 or implicit TLS on port 465. | SPF/DKIM/DMARC receipt checks; unauthorized-domain denial; actual assigned recipient quotas. Workspace outbound routing is a separate integration. |
Acceptance checklist
- Record a unique Message-ID and Queue ID for each controlled test.
- Confirm a destination 250 response and receipt in a mailbox you control; local 250 is only gateway acceptance.
- During an authorized outage verify deferral, retained message age and recovery delivery.
- Test only your own domain and recipients; use approved synthetic samples and an agreed window.
- Preserve evidence and verify customer scope, alias quota, notices and release restrictions where enabled.
Incident triage
Check portal health, delivery history, queue age and last destination error. Distinguish DNS/ownership, service expiry, connection/TLS, temporary 4xx, permanent 5xx and quarantine. Supply domain, UTC time, Queue ID and error to support without secrets.
Rollback
Restore the previously recorded MX/connector settings with your mail administrator. For primary-gateway packages, verify direct receiving before removing gateway source restrictions, without creating an open relay. Keep the service active while accepted gateway queues drain; changing MX does not move already queued messages. Confirm final delivery or agree handling before domain cancellation/deletion. Preserve Backup MX primary routes on shared systems.
Recovery readiness
Agree the recovery scope and documented targets before use. Clustered hosting alone does not demonstrate that application failover has been tested. A restore exercise should record backup date, isolated restore, required keys/configuration, service startup, ownership safeguards and controlled delivery results. No RPO/RTO is published until an operator supplies verified values.
Platform-specific instructions Controlled test evidence