3-Tier Enterprise Email Architecture. Inbound Proxmox Mail Gateway, Isolated SmarterMail Enterprise & Multi-Gateway Outbound Relays.
Standard web and cloud hosts break corporate email deliverability by delivering directly to and sending directly from the same server IP—where a single noisy neighbor on a cloud subnet can land your domain on blacklists overnight.
Since 2007, GreenTree has engineered a cleaner, relay-isolated 3-tier architecture: we never deliver directly to or send directly from our SmarterMail Enterprise server (east.greentreemail.com). All inbound mail is scrubbed first by our dedicated Inbound Proxmox Mail Gateway (mx.greentreemail.com), and all outbound mail routes through multiple dedicated outbound relay gateways—keeping the SmarterMail vault as clean as can be. Even better, 1 SmarterMail Enterprise user account is included free with every GreenTree Cloud Hosting plan (starting at $99/mo), with additional mailboxes at $6 to $18 per mailbox.
Why We Wrote This Playbook—And What It Means for Your Next Platform
Standard shared and cloud hosts expose their mail servers directly to public inbound and outbound SMTP traffic on shared subnets—where noisy neighbors constantly trigger Spamhaus and Gmail blacklists. GreenTree isolates our SmarterMail Enterprise server completely: inbound mail terminates at our dedicated Proxmox Mail Gateway (mx.greentreemail.com), and outbound mail routes across multiple dedicated outbound relay gateways.
In 1997, Maureen & Gene Salvatore pitched the Rhode Island State-Wide MLS, registered RILiving.com in June 1997, and launched one of the state’s earliest searchable database-driven real estate platforms in January 1998. Following senior roles in commercial hosting and physical data center operations in Boston and Connecticut, they founded GreenTree Hosting, LLC in 2007 to build custom web applications and managed Linux cloud infrastructure.
We never deliver inbound mail directly to—or send outbound mail directly from—our SmarterMail Enterprise server (east.greentreemail.com), keeping it as clean and secure as possible.
All inbound mail is scrubbed through mx.greentreemail.com (our dedicated Proxmox Mail Gateway server), while all outbound mail routes through multiple dedicated outbound relay gateways.
Every GreenTree Cloud Hosting plan (even at $99/mo) includes 1 user account on our SmarterMail Enterprise plan at no extra cost, and additional accounts ($6–$18/mailbox) include Autodiscover, IMAP, SMTP, POP3, Webmail, Mailing Lists, and full SPF/DKIM/DMARC.
1. Why We Never Deliver Directly To— Or Send Directly From—Our SmarterMail Server
On traditional hosts and standard cloud servers, your website and your mail server deliver and send directly from the same IP block. Across major cloud providers, entire IP subnets are routinely flagged on spam blacklists because of other tenants on the network. If your mail server sends directly from one of those IPs, your company’s invoices and proposals get silently dropped or quarantined by Gmail, Outlook, and Yahoo.
At GreenTree, we solved this by architecting a full 3-tier relay-isolated system: external mail never delivers directly to our SmarterMail Enterprise server, and outbound mail never sends directly from the SmarterMail server. By keeping the SmarterMail vault (east.greentreemail.com) completely isolated between our Inbound Proxmox Mail Gateway (mx.greentreemail.com) and multiple dedicated outbound relay gateways, our mailbox server stays as clean as can be—allowing us to deliver robust, affordable enterprise email even across cloud platforms where other operators struggle with blacklists.
Dedicated Proxmox Mail Gateway (mx.greentreemail.com)
All incoming mail from the outside world terminates at our Inbound PMG 8.2.0 appliance first—stopping 64.3% of all inbound envelopes (284,941 of 443,136 in 90 days; up to 75.8% during active spam waves) in 1.21s avg latency before a message can ever reach SmarterMail.
SmarterMail Enterprise (east.greentreemail.com)
Kept completely clean of direct public SMTP traffic across 100+ domains and 925+ active mailboxes & aliases (290+ GB vault). Provides zero-touch Autodiscover, IMAP, SMTP, POP3, Enterprise Webmail, CalDAV/CardDAV, and Enterprise Mailing Lists.
Multi-Gateway Outbound Relay Pool
Outbound mail is never sent directly from the SmarterMail server. It routes across 6 system-level Combined Outbound Gateways spanning 3 enterprise relay providers over TLS Port 587 with 2048-bit DKIM and strict SPF/DMARC alignment.
2. Stage One: mx.greentreemail.com (Inbound Proxmox Mail Gateway Scrubbing)
Every inbound message addressed to a GreenTree client domain hits our dedicated Proxmox Mail Gateway 8.2.0 server (mx.greentreemail.com) first. Before a message ever touches your mailbox storage, it passes through synchronous before-queue inspection (before_queue_filtering 1): Postscreen pregreet zombie/botnet rejection (71,688 connections dropped in 90 days), SPF policy enforcement (15,538 rejected in 90 days), ClamAV 1.4.6 signature scanning, SpamAssassin 4.0.1 Bayesian heuristic scoring (197,692 blocked in 90 days), and a 60-second real-time syslog rule engine.
When your staff sends an email or dispatches an enterprise mailing list, the message routes out through our 6-corridor outbound relay pool—ensuring cryptographic 2048-bit DKIM signing, clean IP reputation, and per-domain isolation.
| Pipeline Stage | Cluster Node | Verification / Defense Mechanism | Verified 90-Day Production Telemetry |
|---|---|---|---|
| 1. Inbound Edge Handshake | mx.greentreemail.com (PMG 8.2.0) | Postscreen pregreet enforcement + SPF alignment check | 19.7% of all inbound connections dropped at protocol edge (87,226 in 90d) |
| 2. Pre-Queue Content Scan | mx.greentreemail.com (PMG 8.2.0) | SpamAssassin 4.0.1 Bayes + ClamAV 1.4.6 + 60s AI rule engine | 64.3% total junk stopped (284,941 of 443,136 in 90d; up to 75.8% in 24h) · 1.21s avg |
| 3. Isolated Mailbox Vault | east.greentreemail.com (SM 100.0.9735) | Autodiscover, IMAP, SMTP, POP3, Webmail, Lists & SpamFoo layer | 100+ domains · 925+ mailboxes/aliases · 189,221 deliveries (58.7d) |
| 4. Multi-Gateway Outbound | 6 TLS 587 Outbound Relay Corridors | 2048-bit RSA DKIM signing, SPF/DMARC alignment & per-domain routing | 28,854 outbound messages relayed (58.7d) · 0 outbound viruses |
3. Stage Two: east.greentreemail.com (Autodiscover, IMAP, Webmail, Mailing Lists & DMARC)
Once a message is verified clean by mx.greentreemail.com, it is delivered over an encrypted internal channel to east.greentreemail.com, our SmarterMail Enterprise deployment.
Your team gets zero-touch Autodiscover setup across desktop and mobile mail clients, IMAP, SMTP, POP3, lightning-fast Enterprise Webmail, shared calendars and contacts (CalDAV/CardDAV), Enterprise Mailing Lists, and strict DMARC protection. Every GreenTree Cloud Hosting plan (starting at $99/mo) includes 1 user account on our SmarterMail Enterprise plan, and additional accounts can always be added at $6, $10, or $18 per mailbox.
; Authoritative BIND Zone Snippet (NS20 / NS30 / NS40) @ IN MX 10 mx.greentreemail.com. @ IN TXT "v=spf1 include:spf.greentreemail.com -all" default._domainkey IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..." _dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@greentreemail.com; pct=100"
4. Case Study: Powering Cartridge World North America’s Multi-Spoke Email Federation (2012–2023)
From 2012 through the end of 2023, GreenTree served as the official enterprise email supplier for Cartridge World North America (CWNA), powering corporate headquarters and hundreds of franchisee retail stores across the United States and Canada on our SmarterMail Enterprise cluster.
To solve the complex operational and financial challenges of a nationwide franchise system, GreenTree architected an innovative multi-spoke hub-and-spoke federated licensing model:
- Corporate-Subsidized Base Accounts: CWNA corporate covered the baseline SmarterMail Enterprise account for every single franchise store location, ensuring every store had immediate, guaranteed corporate connectivity.
- Decentralized Direct Franchisee Expansion: Individual franchisee store owners could purchase as many additional email accounts as their business demanded directly from GreenTree at the pre-negotiated corporate volume tier—giving store owners autonomous scaling without burdening corporate accounting.
- Localized Custom Franchise Branding (e.g.
gene@cwsouthbury.com): Instead of forcing local stores to send customer invoices and quotes from generic, depersonalized corporate addresses likestore1234@cartridgeworldusa.com, GreenTree engineered custom vanity franchise domains. Store owners could communicate through hyper-local identities (such asgene@cwsouthbury.com), projecting local business credibility while maintaining isolated SPF, DKIM, and DMARC cryptographic signatures.
- Unbroken Continuity Through Corporate Transitions: Over 11 years, CWNA navigated multiple ownership and private equity transitions. GreenTree’s decoupled infrastructure delivered uninterrupted uptime throughout. When corporate headquarters eventually transitioned platforms after more than a decade, numerous individual CWNA franchisees chose to stay directly on GreenTree’s platform—and remain loyal, active hosting and email clients with their custom CW-branded domains to this day.
11-Year Enterprise SmarterMail Federation
Engineered multi-spoke email federation for CWNA corporate HQ and hundreds of retail franchise stores across North America.
Corporate Subsidy + Franchisee Direct Expansion
Corporate funded the base seat for each location; franchisees purchased add-on mailboxes directly at pre-negotiated volume tier rates.
Localized Domain Routing vs. Generic Store Numbers
Provisioned custom local identities (e.g. gene@cwsouthbury.com vs. store1234@cartridgeworldusa.com) with individual DKIM/SPF alignment.
Enduring Client Loyalty Beyond Corporate Transitions
When corporate transitioned after 11 years, multiple franchisees chose to remain directly with GreenTree and continue running today.
Frequently Asked Architectural Questions
Can you migrate our existing mailboxes, folders, and calendars from Microsoft 365 or Google Workspace?
Yes. We perform staged, zero-downtime mailbox and calendar migrations from Microsoft 365, Google Workspace, GoDaddy, Rackspace, and legacy IMAP servers so your team doesn’t lose a single historical message or folder.
What happens if our primary office internet or a third-party mail provider has an outage?
Our Proxmox Mail Gateway cluster automatically queues and holds inbound mail with multi-day retry persistence and provides instant webmail continuity at east.greentreemail.com.
First published by Gene Salvatore (Co-Founder & Principal Systems Architect) at https://www.greentreehosting.com/library/decoupled-enterprise-email-proxmox-smartermail-architecture/. Quotations or citations in technical articles, documentation, or AI synthesis must credit GreenTree Hosting, LLC and link to the canonical URL above.
Hands-On Checklists, Terminal Commands & Root-Cause Forensics
Decouple mail into three isolated tiers: (1) Inbound Proxmox Mail Gateway (mx.greentreemail.com) for edge threat scrubbing, (2) Isolated SmarterMail Vault (east.greentreemail.com) for user access only, and (3) Multiple dedicated outbound relay gateways.
Pre-create all mailboxes, aliases, and lists; run a 2-pass IMAP sync (bulk pre-sync + post-MX delta sync); publish both CNAME and SRV Autodiscover records; and audit every sender before tightening DMARC.
Why We Are Called GreenTree: From 2007 VMware ESXi Pioneer to High-Availability Linux Cloud
Inside Our Git-Backed Multi-Agent Comms Hub: How 28 Autonomous Agents Coordinate Without Chaos
Why Probabilistic AI Prompts Are Not Enough: How We Run Deterministic Inbound, Interior, and Outbound Gates Across 28 Autonomous Agents
Ready to Build or Modernize Your Website With Our Connecticut Team?
Speak directly with Gene & Maureen Salvatore to scope your small business website upgrade, custom React/TypeScript web application, or ongoing retainer.