>Very interesting your answer. The most clear I ever saw regarding how to
>make a safe system.
>
>I have 2 question, regarding of this:
>1. Should have S2 all the same like S1 ? I mean, accounts, lists, etc. or
>just the service ?
no, emphatically. The s2 machine is only a SMTP relay machine for the SMTP
traffic that can't be delivered to unreachable s1. All the accounts on s1
absolutely must NOT be duplicated on s2. The s1 mail is never "delivered"
to s2, but only "relayed" through s2 on the way to being "delivered"
ultimately, exclusively to s1.
While s1 is unreachable, the s1 mail is stored temporarily on s2. During
s1's unreachability, user's cannot access, for reading, their mail stored
on s2. They must wait until s1 is back on-line and s2 relays the mail to s1
where s1 "delivers" the mail to the users' s1 mailboxes.
While s1 is unreachable, your s1 users CAN send their mail through s2 but
they have to reconfigure their mail client programs to "send mail" through
s2. (The s1 users cannot receive mail through s2.)
So that users can send mail temporarily through s2, you have to make sure
that s2 is set to "relay for addresses" since s2 cannot authenticate the s1
mail senders (s1 mail senders don't have accounts on s2 and are not
considered to be local users or local domain (and s2 can't SMTP AUTH the s1
users), I think only relay for addresses will work in this crisis
situation, and your users have to call in from ip addresses in your "relay
for" address list)
>2. I did a setup like this time ago, and the S2 was intercepting emails to
>S1, so never reach the user. It is possible ?
yes, of course, if s2 is only to be a 2ndary relay server for s1, then the
s1 accounts are not to be created on s2, or, as you found out, the s1 mail
will be delivered to s2.
>I did something wrong ?
si, si !
btw, you can create other Imail domains and accounts on s2 (different from
those on s1) and use s1 as the secondary mail relay for s2. This allows
you to load-balance your total mail burden on two machines, while having
each one secondary for the other. Optionally, you can add peering between
s1 and s2.
>I am using MS DNS !.
For security and performance reasons, I recommend you switch to BIND 8 for
NT. The NT binary is here: ftp://ns4.netpacq.net.
Regards,
Len
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
