Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm a bit confused how mail servers work, and the process of setting them up. Say I have an domain called example.com, and I have an A record for it. I'll be using postfix/dovecot for this setup along with an SSL certificate.

When setting all this up, do I create a new A record for mail.example.com, as well as a MX record for mail.example.com, and assign the cert to mail.example.com, even though all mail is being sent to example.com accounts? Will this work, or does everything need to be pointed to just example.com?

In all the documentation I've read, everything says set up the mail server as a subdomain, and assign all the hostnames, MX records, A records (for webmail), and SSL certs to that. Just want to make sure I'm on the right path here.

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

Yep, you've got it right. Do all of that.

Here's why:

Usually (and traditionally) example.com does not resolve to an actual host, or is the same as www. In order to decouple the domain name from the host that handles mail delivery for a domain name, a separate mail exchanger (MX) is designated.

When mail is destined to example.com the sending (or relaying) MTA will look up the MX for example.com. If more than one MX is returned connections will be attempted to each in priority order. When the sending MTA contacts the MX the hostname specified in the MX must match the certificate supplied by the server in order to validate properly.

If there are no MX records for example.com then the sending MTA look up the A record for and attempt to contact example.com directly. If there's no A or CNAME the message will be bounced.

share|improve this answer
    
To be clear, the MX record needs to be at example.com, not mail.example.com. –  Chris Down Jan 2 at 9:14
    
But should mail and ssl certs be pointed to mail.example.com? It seems that @bahamat says that everything needs MX records for the sub, ssl certs to the sub, and postfix hosts to the sub. Will that work is an email is directed to just user@example.com? –  Noel Forte Jan 2 at 17:06
1  
Yes, the certificate should be for the sub. If the MX record for example.com is foo.example.com, then remote mail servers will connect to foo.example.com. They will expect it to answer with a cert for foo.example.com. –  bahamat Jan 2 at 20:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.