Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

I'm a bit confused how mail servers work, and the process of setting them up. Say I have an domain called, and I have an A record for it. I'll be using postfix/dovecot for this setup along with an SSL certificate.

When setting all this up, do I create a new A record for, as well as a MX record for, and assign the cert to, even though all mail is being sent to accounts? Will this work, or does everything need to be pointed to just

In all the documentation I've read, everything says set up the mail server as a subdomain, and assign all the hostnames, MX records, A records (for webmail), and SSL certs to that. Just want to make sure I'm on the right path here.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Yep, you've got it right. Do all of that.

Here's why:

Usually (and traditionally) does not resolve to an actual host, or is the same as www. In order to decouple the domain name from the host that handles mail delivery for a domain name, a separate mail exchanger (MX) is designated.

When mail is destined to the sending (or relaying) MTA will look up the MX for If more than one MX is returned connections will be attempted to each in priority order. When the sending MTA contacts the MX the hostname specified in the MX must match the certificate supplied by the server in order to validate properly.

If there are no MX records for then the sending MTA look up the A record for and attempt to contact directly. If there's no A or CNAME the message will be bounced.

share|improve this answer
To be clear, the MX record needs to be at, not – Chris Down Jan 2 '14 at 9:14
But should mail and ssl certs be pointed to It seems that @bahamat says that everything needs MX records for the sub, ssl certs to the sub, and postfix hosts to the sub. Will that work is an email is directed to just – Noel Forte Jan 2 '14 at 17:06
Yes, the certificate should be for the sub. If the MX record for is, then remote mail servers will connect to They will expect it to answer with a cert for – bahamat Jan 2 '14 at 20:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.