I'm a bit confused how mail servers work, and the process of setting them up. Say I have an domain called example.com, and I have an A record for it. I'll be using postfix/dovecot for this setup along with an SSL certificate.

When setting all this up, do I create a new A record for mail.example.com, as well as a MX record for mail.example.com, and assign the cert to mail.example.com, even though all mail is being sent to example.com accounts? Will this work, or does everything need to be pointed to just example.com?

In all the documentation I've read, everything says set up the mail server as a subdomain, and assign all the hostnames, MX records, A records (for webmail), and SSL certs to that. Just want to make sure I'm on the right path here.

1 Answer 1


Yep, you've got it right. Do all of that.

Here's why:

Usually (and traditionally) example.com does not resolve to an actual host, or is the same as www. In order to decouple the domain name from the host that handles mail delivery for a domain name, a separate mail exchanger (MX) is designated.

When mail is destined to example.com the sending (or relaying) MTA will look up the MX for example.com. If more than one MX is returned connections will be attempted to each in priority order. When the sending MTA contacts the MX the hostname specified in the MX must match the certificate supplied by the server in order to validate properly.

If there are no MX records for example.com then the sending MTA look up the A record for and attempt to contact example.com directly. If there's no A or CNAME the message will be bounced.

  • To be clear, the MX record needs to be at example.com, not mail.example.com.
    – Chris Down
    Jan 2, 2014 at 9:14
  • But should mail and ssl certs be pointed to mail.example.com? It seems that @bahamat says that everything needs MX records for the sub, ssl certs to the sub, and postfix hosts to the sub. Will that work is an email is directed to just user@example.com?
    – Noel Forte
    Jan 2, 2014 at 17:06
  • 1
    Yes, the certificate should be for the sub. If the MX record for example.com is foo.example.com, then remote mail servers will connect to foo.example.com. They will expect it to answer with a cert for foo.example.com.
    – bahamat
    Jan 2, 2014 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.