How to configure DNS Records for Inbound Relay

9 hours ago
sorb
3 minutes

Problem Statement

When configuring a Inbound Relay using an FQDN, the system may connect to an unexpected mail server instead of the server specified by the FQDN’s A record.

For example, the Inbound Relay is configured as:

mail.example.com

with the following DNS records:

mail.example.com.    A     10.10.10.20
mail.example.com.    MX    10 mail.example.com.

Administrators may expect the system to connect directly to 10.10.10.20 based on the A record. However, if the configured FQDN has an MX record, the system will use the MX record for mail delivery instead of directly using the A record.

This can result in mail being delivered to a different server or following an unexpected mail routing path.

Cause

The Inbound Relay is used for mail delivery, so DNS resolution follows standard mail-routing behavior.

When the configured FQDN has an MX record, the system treats the FQDN as a mail destination and uses its MX record to determine the next mail server.

The important distinction is:

  • FQDN with MX record → System uses the MX record for mail delivery.
  • FQDN without MX record → System can resolve the hostname through its A/AAAA record and connect directly to that address.

For example:

relay.example.com.    A     10.10.10.20
relay.example.com.    MX    10 mail.example.com.

If relay.example.com is configured as the Next Hop, the system will use:

mail.example.com

as the mail destination rather than directly connecting to:

10.10.10.20

Therefore, an FQDN intended to represent a specific relay server should generally not have an MX record pointing elsewhere.

Resolution

Configure a dedicated hostname for the Next Hop and ensure that it resolves directly to the intended mail server.

Recommended DNS configuration

For example:

smtp-relay.example.com.    A    10.10.10.20

Do not configure an MX record for smtp-relay.example.com if the intention is for the system to connect directly to its A record.

Then configure the Next Hop as:

smtp-relay.example.com

The expected DNS configuration is:

smtp-relay.example.com.    A    10.10.10.20

and no MX record should exist for that hostname.

Verify the DNS configuration

Use the following commands:

dig A smtp-relay.example.com
dig MX smtp-relay.example.com

Expected result:

smtp-relay.example.com.    A    10.10.10.20

The MX query should return no MX record for the dedicated relay hostname.

If an MX record exists, review whether it is required. If the Next Hop is intended to connect directly to the specified server, remove the MX record or use a dedicated hostname that does not have an MX record.

Please reach out to wecare@sorbsecurity.com if you have any questions.