IBM Smarcloud : pay attention on smtp routing to your internal server ( CE datacenter )

During the current day some IBM smtp servers of European datacenter has start to delivery mail from smtp1.ce.collabserv.com instead the usual smtp.ce.collabserv.com

If you have set your smartcloud environment to route the mail for external domain to an SMTP server and you have enforced the check of the FQDN (like i did in this previous blogpost) you have to add also smtp1.ce.collabserv.com or you can extend the SMTP security to the domain ce.collabserv.com .

IBM Domino HowTo: Determining the number of mailboxes required for server and set smtp relay as failover or loadbalancing

During last days I was setting some things on domino servers so i like to recap 2 basic topic that I know is not so popular as they must be inside Admin community

Determining the number of mailboxes

Here I suggest to start with this basic rule: if a Domino server is a mail server start with 2 mailbox.
If you like to know if your environment could be run better with more mailboxes you have to make this expression:

(Mail.Mailbox.AccessConflicts / Mail.Mailbox.Accesses) x 100  

If the result is greater than 2 you have to add a mailbox. 

To obtain the 2 stats use the following command on Domino console

show stat mail

Here the descriptions of the stats

Mail.Mailbox.Accesses	Total number of times that threads accessed any mailbox on the server.
Mail.Mailbox.AccessConflicts	The number of times that a thread attempting to access a mailbox had to wait because the number of concurrent threads exceeded the number of mailboxes configured. For example, if there are three mailboxes configured, and there are four concurrent accesses, the conflict count would be incremented. If the number of access conflicts consistently exceeds two percent of the value of Mail.Mailbox.Accesses, consider creating an additional mailbox.

Read this technote to have more detail

SMTP Mail relay - Load Balancing / Fail Over

If you have to use an SMTP relay from a Domino server you have to go on config document of the server on  tab Router/SMTP --> Basics and set the value Relay host for messages leaving the local internet domain.

Here you can use comma or semicolon as a separator between the hosts
eg

[10.1.2.3],[10.1.2.4]   here we have a load balancing using random access

[10.1.2.3];[10.1.2.4]   here we have failover between the first one and than the second one

 Check this slides  to have more detail about this topic and SMTP in general

IBM Smartcloud Hybrid , setup an SMTP mail relay using the domino Passthru Server

When you set-up IBM Smartcloud Hybrid config you will see the migrated users e-mail will be send directly from the service SMTP.
If your company policies requires that emails should be sent from an internal server (eg. journaling, managed signature,centralized AV-spam, whatever ) you can set an SMTP relay from the account settings

Manage My Company --> IBM Smartcloud Notes -> Account Settings

Email Management here you can set the SMTP relay, and you can set 1 hostname or IP address.

 

The Smtp from service support STARTLS so if your relay server can do same the e-email flow will be encrypted.

I've asked to IBM support if was possible to set and authentication for SMTP relay  and they have created this SPR #TPON9VBCRT for the enanchement request.

If you haven't already an SMTP relay published you can use for example the Domino Passthru server set-up for the hybrid configuration.

Before that we have to enable and secure the SMTP on this server:

On first enable the SMTP listener on the basic tab of server document, than going to configuration document (create a new one if you haven't ) 

Router SMTP --> Restriction and Control --> SMTP Inbound  and set as below

 

thank going down to the page and set as below

If you are on Europan datacenter  set  smtp.notes.eu.collabserv.com

Now we have to set the internal relay from Passthru  to the other internal mailserver

Server config --> Router SMTP --> Basic

Now you are ready to open the TCP-IP port 25 from internet through the domino server and through the Passthru server to the internal mail server.

I suggest also to set-up STARTLS as written in this technote so the service SMTP can use this protocol to secure the mail relay.

This will be the mail flow

from service : mail to user in service --->  NRPC protocol cloud2cloud 

from service: mail to on premise user -->  NRPC protocol cloud 2 on premise 

from service : mail to internet --> SMTP relay to domino Passthru server  --> SMTP relay to local server

If you have trouble with SMTP delivery check PTR, SPF , DKIM and DMARC record of your domain

In last days I've worked on some customer SMTP delivery issue and i like to make a recap on settings I've check and modified..

PTR Record

The PRT record of  the SMTP internet relay is fundamental ! A lot of SMTP server who work as e-mail receiver first check if exist the reverse configuration of the ip address and if not drop the SMTP connection instantly without make any other check! This is because the PTR record isn't usually set on every IP and rarely is set on spammer SMTP servers.

SPF Record

The SPF (sender policy framework) record is a TXT record who declare the allowed IP addres sender by domain. If this record exist the SMTP receiver could check it and drop the e-mail received from others IP address.

For example if you like to set a SPF record who allow all your MX server to send internet mail you could set a SPF like this:

"v=spf1 mx -all"

On other environment if you like to set a IP range of SMTP server from 192.168.0.1 to 192.168.255.255 you could set a SPF like this:

"v=spf1 ip4:192.168.0.1/16 -all"

On this page you could find protocol directive and some examples and  on this page you could find online tool to check your record.

DKIM

Having a validated source of SMTP IP address could not be enough in case of IP spoofing so we could use a DomainKeys Identified Mail (DKIM) record.

To use Dkim your SMTP relay have to digitally sign the headed of every e-mail sent.and the corrisponded public key have to put on internet DNS on a TXT record.

For example on my msbiro.net domain I've created a TXT record named

msbiro._domainkey

with following value :

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4HaRa97JsN7F9Np8bHhmBj06tCiwTucGPiPG5C4bZLmbCu1P5P12fExGzEkmZUy6hd4KwVPQVWgbcFvxZTOs5iA6TzxtQe6QCr2l0EX9AYtP5ykkA3HLlRmhAkmCJTsEh/kEEdLbP3LQ78RVk+E1ZLA//BPrDikRym3/EFvfhKwIDAQAB

v= is protocol version ,
k= is the encription algorithm used
p= is the public key associated on my domain

At this address you could find all info and  on this site you could find a test application to verify your TXT record.

NOTE: the use of DKIM is restricted to the use of an SMTP server that supports this technology. In this case I've used as SMTP gateway Scrollout F1, who is a SMTP appliance released on iso format available though GNU GPL licence.

DMARC

Dmarc (Domain-based Message Authentication, Reporting and Conformance) is another TXT record who could extend the possibility of SPF and DKIM record.

Through the record DMARC you can set a threshold percentage of messages that can fail the checking SPF or DKIM and tell the SMTP server if have to mark the failed e-mail as Junk  (entrusted) or if have to discard them.

The really handy feature of this record is that you set up a mailbox to which the SMTP server that receive messages, send a daily report in XML format containing the violations received on the policy DMARC of your domain.

An example of record DMARC coud be the following,

host :

_dmarc 

valore:

v=DMARC1; p=quarantine; pct=1; rua=mailto:postmaster@msbiro.net

v= is protocol version ,

p= represent the policy is to be applied 

pct=1 represents the percentage of messages subject to filtering and 1 says to monitor all the messages without imposing junk or drop 

rua= tells what address to send the report XML messages that fail the check.

The activation record dle DMARC it is advisable to increase, starting from the monitoring arriving up to 100% of the messages in the drop.

The advantage about implementation of  this record on  monitoring status is that that you can get the record with the sources of e-mails that violate the policy SPF or DKIM and thus be able to know whether to make adjustments to the routing of our e-mails.

On this page you could find the DMARC directive and on here you could find a tool to verify that  .