Setting MX entries for Failover

Question

I have a GoDaddy domain as "example.com". I wanted to have my own DNS server for the sub domain secure.example.com. So I added a "A" record "NS" pointing to my IP and a NS record "Secure" pointed to "ns.example.com" in GoDaddy. This works fine and all DNS queries are hitting my server for "secure.example.com". Now I am setting up my mail servers for the same subdomain. I have setup two mailservers. One is primary and the other one is backup. So in my DNS server the MX entries are :

MX :
secure.example.com -> primary.secure.example.com  0 (priority)
secure.example.com -> backup.secure.example.com   5 (priority)

A records :
primary.secure.example.com -> IP Address 1
backup.secure.example.com -> IP Address 2

Now If I use a mail client (outlook, live, thunderbird) and give "secure.example.com" as POP3 and SMTP, It brings up the emails and connects to IP address of the primary server. Which is good. Now I stopped the primary mail server and tried to send emails. But all my mail clients are still trying to connect to primary and not trying the backup server. What am I missing in my configuration?

Solution

MX records are only for Mail Delivery (SMTP), and SMTP is smart enough to try the backup with lower priority when it fails. It also only applies to MTA's using the MX records. Client Applications do not use the MX records, they do not "deliver" e-mails, they just connect to the SMTP Server (through the A record). The SMTP server then "delivers" the e-mail.

What you want is some type of hardware/software loadbalancer with a Virtual IP.

Comments

[metacom]

What is the ttl on the MX records? Hvae you flushed the DNS cache of the client machines? I suspect that it is using the cached mx info. You also have to wait for the changes to propgate

[pili]

TTL is 86400. Yes I did flush the DNS Cache.

[joeqwerty]

Now I stopped the primary mail server and tried to send emails. But all my mail clients are still trying to connect to primary and not trying the backup server - Your servers are not providing High Availability for your email clients and that is not what MX records are for.

[pili]

So these MX are for remote mail server and not for mail clients? Is this same for NS and DNS server? How do I solve my problems without using MX and additional hardware. Because I am using Amazon cloud servers

[pili]

Lets say the mail client connects to a smtp server "smtp.mydomain.com". But that server is down. Now I want the mail client to connect to smtp2.mydomain.com. You mean to say this is not possible through MX entries?

[MichelZ]

Yes, this is not possible. You would need to tell your client to connect to smtp2.mydomain.com instead of smtp.mydomain.com manually, or use a loadbalancer / HA device which switches the server IP of smtp.mydomain.com to the backup server. You can achieve this for example using HAProxy

[pili]

Ok. So MX entries are useful when some remote mailserver tries to connect to our mail server? At that time if one of our mail server is down it will try to find the other one? But this is not helpful if our users are connecting our mail server. I am using Amazon servers, Is there way to do this without using the devices. By setting up some A records for my subdomain?

[Rex]

You can setup round robin DNS but that isn't ideal for you. If you are using Amazon route 53 for DNS, you can setup DNS record failover for a little additional cost that will change the A record to you failover IP when it detects a host failure. Neither method is foolproof but the DNS failover is likely a better option for you right now if you don't want to add in another device.

[Rex]

Other DNS providers offer the same service. I only mention Amazon since you are already using AWS.

[pili]

@Rex, I am not using the Amazon rt 53 DNS. I have dns server running in the server. I can do that A record setting that you mentioned. Could you please elloborate the settings please.

[MichelZ]

Elastic load balancing would be the Amazon product for this

[pili]

@Rex, I have my own dns server running in one of my amazon server. Instead of using amazon load balancing, Can I use my dns server. I am not getting the required settings for A record and CName or NS. Trying to figure out the dns types when webclient tries to connect to SMTP To dwonload the messages.