--- title: "Running SmarterMail in Production: Why Your Mailbox Server Should Never Accept Direct Internet Mail or Send Directly to the Outside World | GreenTree Field Notes" url: https://www.greentreehosting.com/field-notes/smartermail-relay-isolation-and-multi-gateway-outbound-architecture/ description: "By Gene Salvatore: Production 3-tier SmarterMail architecture runbook—Inbound Proxmox Mail Gateway (mx.greentreemail.com), isolated SmarterMail Enterprise vault (east.greentreemail.com), and multiple dedicated outbound relay gateways." format: text/markdown generated_from: prerendered HTML (build time) --- [ALL SYSADMIN FIELD NOTES & RUNBOOKS](https://www.greentreehosting.com/field-notes) FN-2026-01 // SMARTERMAIL OPSSmarterMail & Mail Ops · 7 min read # Running SmarterMail in Production: Why Your Mailbox Server Should Never Accept Direct Internet Mail or Send Directly to the Outside World After decades of running commercial email servers, the single biggest mistake we see on self-hosted SmarterMail, Exchange, and control-panel mail servers is letting the mailbox server talk directly to the public internet on port 25. Here is how our 3-tier relay-isolated architecture keeps client inboxes clean and outbound mail out of spam folders. Published: 2026-10-25•Last tested: 2026-10-25•Tested in Production on Proxmox Mail Gateway 8.2.0 (Kernel 6.8.12-43-pve / SpamAssassin 4.0.1 / ClamAV 1.4.6) + SmarterMail Enterprise Build 100.0.9735 01 // THE SYMPTOM Legitimate company emails start bouncing or landing in Gmail/Outlook Junk folders, or the SmarterMail server CPU spikes during inbound spam waves and dictionary attacks. 02 // THE ROOT CAUSE The SmarterMail mailbox server is exposed directly as the public MX host and sends outbound mail directly from its own IP—so a single noisy forwarder, compromised password, or botnet flood tarnishes the server IP. 03 // THE PERMANENT FIX Decouple mail into three isolated tiers: (1) Inbound Proxmox Mail Gateway (mx.greentreemail.com) for edge threat scrubbing, (2) Isolated SmarterMail Vault (east.greentreemail.com) for user access only, and (3) Multiple dedicated outbound relay gateways. PERIMETER ELIMINATION (90D) 64.3% Blocked 284,941 of 443,136 inbound envelopes stopped at mx.greentreemail.com (up to 75.8% in 24h peaks) PROTOCOL HANDSHAKE DROPS 19.7% @ TCP/SPF 87,226 connections (90d) dropped by Postscreen pregreet (71,688) & SPF (15,538) before content scan PRE-QUEUE SCAN LATENCY 1.21s Avg Synchronous ClamAV 1.4.6 + SpamAssassin 4.0.1 inspection before delivery to SmarterMail 100.0.9735 ACTIVE VAULT FOOTPRINT 100+ Domains 925+ active mailboxes & aliases (290+ GB vault) + 6 TLS 587 outbound relay gateways (2048-bit DKIM) **Sysadmin Safety Notice:**Test DNS MX, SPF, and firewall port-25 restrictions on a staging domain first. Never block port 25 on your mailbox store until you have verified that your inbound gateway can deliver to it internally. INTERACTIVE SYSADMIN RUNBOOK · SAVED IN YOUR BROWSER ## Interactive SmarterMail Production Hardening Checklist Check off each item to audit your own SmarterMail or business mail server against our production standard: PROGRESS: 0 OF 6 STEPS VERIFIED (0%)CLICK ANY STEP TO CHECK OFF Remove the SmarterMail host from public MX records Point all client domain MX records exclusively to an upstream scrubbing gateway (such as Proxmox Mail Gateway on mx.greentreemail.com) rather than the mailbox server hostname. Restrict port 25 inbound on the SmarterMail server to your gateway IPs Configure firewall/SMTP binding rules so unauthenticated internet hosts cannot bypass your MX gateway and inject spam directly into the SmarterMail IP. Route all outbound SmarterMail delivery through dedicated smart-host relay gateways Never let the mailbox store send directly to external MX servers. Use a pool of reputation-monitored outbound relays. Disable unauthenticated SMTP relay and require TLS on submission ports (587 / 465) Enforce SMTP Authentication + TLS 1.2/1.3 for every client device sending outbound mail. Set per-user and per-domain hourly outbound rate limits inside SmarterMail If an employee’s laptop or password is compromised, automatic outbound throttling prevents a spam burst from damaging your outbound relay reputation. Publish 2048-bit DKIM keys, strict SPF (-all), and DMARC on every hosted domain Sign every outbound message at the domain level and verify alignment before enforcing p=quarantine or p=reject. FIELD NOTE 01 // THE SINGLE-BOX MAIL TRAP ## 1. Why Running Inbound MX, Mailbox Storage, and Outbound SMTP on One IP Eventually Breaks SmarterMail is one of the finest commercial email platforms ever written—fast, clean, free of per-seat bloatware tax, and rock-solid on storage. We have run it for years. But when someone installs SmarterMail on a single server, points their MX record straight at that server’s IP, and lets that same IP send outbound mail directly to Gmail, Microsoft 365, and Yahoo, they are setting a trap for themselves. On the public internet, port 25 is hit around the clock by botnets testing dictionary wordlists, sending malformed MIME payloads, and probing for open relays. If your mailbox server handles that raw port 25 traffic directly, its CPU and disk I/O spend half the day fighting junk instead of serving your team’s Outlook, iPhone, and Webmail sessions. Even worse is the outbound side: if one user on a single-box mail server sets up an external auto-forwarder to a personal address—and a spam message gets forwarded out—the receiving provider sees your SmarterMail IP forwarding spam and places that IP on a blocklist. Instantly, every customer on that server has their legitimate invoices and proposals rejected. | Mail Layer | Typical Single-Server Mail Setup | GreenTree 3-Tier Relay-Isolated Architecture | | --- | --- | --- | | Inbound Port 25 (MX) | Public internet connects directly to the mailbox server | Terminates at Proxmox Mail Gateway (mx.greentreemail.com) for 8-stage scrubbing | | Mailbox Storage & Sync | Shares CPU, RAM, and IP reputation with raw SMTP traffic | Isolated SmarterMail Enterprise vault (east.greentreemail.com) for authenticated users only | | Outbound Delivery | Sent directly from the mailbox server IP (single point of RBL failure) | Routed across multiple dedicated outbound relay gateways with automatic health monitoring | | Compromised Account Containment | Can blacklist the entire server before an admin notices | Per-mailbox hourly rate limits + outbound gateway anomaly detection | FIELD NOTE 02 // THE 3-TIER ARCHITECTURE ## 2. How We Structure Inbound PMG, Isolated SmarterMail, and Multi-Gateway Outbound Delivery In our production email environment (`east.greentreemail.com`, running **SmarterMail Enterprise Build `100.0.9735`** behind **Proxmox Mail Gateway `8.2.0`** on `mx.greentreemail.com`), we separate email into three distinct jobs so no single failure mode can cross over: • **Tier 1 — Inbound Edge Scrubbing (`mx.greentreemail.com` · PMG `8.2.0`):** Every domain we host points its MX record to our Proxmox Mail Gateway appliance (`Kernel 6.8.12-43-pve`, `SpamAssassin 4.0.1-2`, `ClamAV 1.4.6`, local `Unbound` resolver). Across our last 90-day production window (**`443,136` inbound envelopes** / **`126,916` in the last 30 days**), **`284,941` junk and malicious messages (`64.30%`, and up to `75.79%` during peak 24-hour spam waves)** were stopped at the perimeter before ever reaching SmarterMail. Postscreen pregreet enforcement (`71,688` botnet drops in 90d) and SPF rejection (`15,538` in 90d) terminate **`19.7%` of all inbound connections** at the TCP/protocol handshake before content scanning, with an average full-inspection latency of **`1.21 seconds`**. • **Tier 2 — The Isolated SmarterMail Vault (`east.greentreemail.com` · Build `100.0.9735`):** Because the gateway handles the front door, SmarterMail only serves authenticated users (across **`100+` primary domains**, **`925+` active mailboxes & aliases**, and **`290+ GB` of live mailbox storage**) and our internal gateway transport (`189,221` messages delivered over the last 58.7-day uptime window, with SpamFoo secondary vault filtering catching an additional `11,033` low/medium/high spam messages). • **Tier 3 — 6-Corridor Multi-Provider Outbound Relay Pool:** When a user hits Send in Outlook, Apple Mail, or Webmail, SmarterMail routes that message out across **6 system-level Combined Outbound Gateways** spanning 3 independent enterprise relay providers over TLS Port `587` (plus per-domain outbound corridors)—relayed with **100% 2048-bit RSA DKIM signing**, non-destructive SPF alignment, and strict DMARC enforcement (`28,854` remote outbound messages relayed over the last 58.7 days with zero outbound virus incidents). Reference DNS Pattern for a 3-Tier Relay-Isolated SmarterMail Domain ``` ; GreenTree Hosting, LLC — Reference SmarterMail DNS Records ; 1. Inbound MX points strictly to the Proxmox Mail Gateway (never the mailbox store) @ IN MX 10 mx.greentreemail.com. ; 2. Autodiscover points clients (Outlook / iOS / Apple Mail) to the SmarterMail Vault autodiscover IN CNAME east.greentreemail.com. _autodiscover._tcp IN SRV 0 0 443 east.greentreemail.com. ; 3. SPF authorizes only our outbound relay gateways (-all hard fail) @ IN TXT "v=spf1 include:spf.greentreemail.com -all" ; 4. 2048-bit DKIM public key & DMARC policy default._domainkey IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..." _dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@greentreehosting.com; pct=100; adkim=s; aspf=s" ``` ⚠ Test on a non-production system first and verify backups before running administrative commands. SYSADMIN Q&A ## Common Questions on SmarterMail 3-Tier Relay Isolation ### Why shouldn’t my MX record point directly to mail.mydomain.com on the SmarterMail server? When your MX record points directly to the mailbox server, spammers and botnets hammer your mailbox server’s CPU and disk directly on port 25. Placing a dedicated Proxmox Mail Gateway (mx.greentreemail.com) in front of SmarterMail blocks malware, phishing, and botnets at the network edge before they ever reach your mailbox storage. ### What happens if an external mail provider temporarily throttles or blocks an outbound IP? Because SmarterMail sends outbound mail through our pool of dedicated outbound relay gateways rather than from a single static server IP, we can route traffic across healthy relay gateways immediately without touching client DNS records or reconfiguring user devices. ### Does forwarder spam affect outbound IP reputation on SmarterMail? Yes—unfiltered external auto-forwarders are one of the most common causes of IP blacklisting on traditional mail servers. By scrubbing inbound mail through Proxmox Mail Gateway first and enforcing SRS/DKIM and rate limits on outbound relays, we prevent forwarded spam from poisoning outbound delivery. COMPANION CORNERSTONE REFERENCE GUIDE (/LIBRARY) ### Inside Our 3-Tier Enterprise Email Architecture: Inbound PMG, SmarterMail Enterprise & Multi-Gateway Outbound Read the full 3,500+ word architectural breakdown of how our Proxmox Mail Gateway and SmarterMail Enterprise stack compares against per-seat Microsoft 365 and Google Workspace. [Read Full Engineering Guide](https://www.greentreehosting.com/library/decoupled-enterprise-email-proxmox-smartermail-architecture) MANAGED SMARTERMAIL ENTERPRISE ### Want Your Domain on Our 3-Tier Proxmox + SmarterMail Stack? Every $99/mo Core Cloud and $199/mo Core Cloud + Management hosting plan includes 1 SmarterMail Enterprise mailbox free. Additional mailboxes are $6/mo (25 GB Core), $10/mo (50 GB Business & Lists), or $18/mo (100 GB Executive Vault)—and existing customers keep their grandfathered rates. [Explore SmarterMail Plans ($6–$18/mo)](https://www.greentreehosting.com/email)[Run Free DMARC & DNS Auditor](https://www.greentreehosting.com/tools/email-deliverability-and-dns-sovereignty-auditor) RELATED FIELD NOTES & RUNBOOKS ## Related Notes From the Sysadmin Desk [View All 8 Field Notes](https://www.greentreehosting.com/field-notes) [SmarterMail & Mail Ops8 min readTransferring Business Email to SmarterMail Without Breaking Outlook, iPhones, Shared Calendars, or DMARCPre-create all mailboxes, aliases, and lists; run a 2-pass IMAP sync (bulk pre-sync + post-MX delta sync); publish both CNAME and SRV Autodiscover records; and audit every sender before tightening DMARC.Open Field Note & Checklist](https://www.greentreehosting.com/field-notes/smartermail-mailbox-migration-autodiscover-and-dmarc-alignment)[DNS & Linux Infrastructure7 min readAuthoritative BIND DNS in the Real World: Why Secondary Nameservers Serve Stale TTLs (And How to Catch Zone Drift in 60 Seconds)Always increment the YYYYMMDDnn SOA serial before rndc reload, strip stale per-record TTL overrides, align registrar glue/NS records with the zone, and query every delegated nameserver directly.Open Field Note & Checklist](https://www.greentreehosting.com/field-notes/bind-dns-soa-serial-drift-and-60-second-ttl-troubleshooting)[Server Transfers & Cutovers9 min readThe Zero-Downtime Server Transfer Runbook: How We Move Live Websites, Databases, and Mailboxes Without Losing a Single Order or EmailExecute a 5-stage cutover: lower DNS TTLs to 60 seconds 48 hours early, stage and test via local hosts-file override, pre-issue TLS certificates, run a final sub-second rsync + database delta sync, and enforce a 5-source 301 redirect map.Open Field Note & Checklist](https://www.greentreehosting.com/field-notes/zero-downtime-server-migration-and-cutover-runbook)