--- title: "Inside Our 3-Tier Enterprise Email Architecture: Inbound PMG, SmarterMail Enterprise & Multi-Gateway Outbound" url: https://www.greentreehosting.com/library/decoupled-enterprise-email-proxmox-smartermail-architecture/ description: "Why we never deliver directly to or send directly from our SmarterMail Enterprise server: Inbound PMG (mx.greentreemail.com), isolated SmarterMail (Autodiscover, IMAP, SMTP, POP3, Webmail, Mailing Lists & DMARC), and multiple outbound relay gateways." format: text/markdown generated_from: prerendered HTML (build time) --- [Back to Cornerstone Engineering Library](https://www.greentreehosting.com/library) ENTERPRISE EMAIL & SECURITY8 MIN READAUTHORED BY GENE SALVATORE # 3-Tier Enterprise Email Architecture. Inbound Proxmox Mail Gateway, Isolated SmarterMail Enterprise & Multi-Gateway Outbound Relays. Standard web and cloud hosts break corporate email deliverability by delivering directly to and sending directly from the same server IP—where a single noisy neighbor on a cloud subnet can land your domain on blacklists overnight. Since 2007, GreenTree has engineered a cleaner, relay-isolated 3-tier architecture: we **never deliver directly to or send directly from our SmarterMail Enterprise server (`east.greentreemail.com`)**. All inbound mail is scrubbed first by our dedicated **Inbound Proxmox Mail Gateway (mx.greentreemail.com)**, and all outbound mail routes through **multiple dedicated outbound relay gateways**—keeping the SmarterMail vault as clean as can be. Even better, **1 SmarterMail Enterprise user account is included free** with every GreenTree Cloud Hosting plan (starting at $99/mo), with additional mailboxes at [$6 to $18 per mailbox](https://www.greentreehosting.com/email). INBOUND PMG 8.2.0 64.3% Stopped 284,941 of 443,136 Envelopes (90d) Blocked at mx.greentreemail.com (Up to 75.8% in 24h Peaks · 1.21s Avg Scan) OUTBOUND RELAYS 6 TLS Gateways Multi-Provider Outbound Relay Pool (28,854 Relayed in 58.7d · 2048-Bit DKIM) — Never Sent Directly From Vault SMARTERMAIL 100.0.9735 100+ Domains 925+ Active Mailboxes & Aliases (290+ GB Vault) · Autodiscover, IMAP, Webmail, Lists & DMARC at east.greentreemail.com ECONOMICS $6–$18 / mo 1 Enterprise Account Included Free With $99+ Hosting · Add’l Accounts $6 / $10 / $18 EXECUTIVE THESIS // ARCHITECTURAL BRIEF ## Why We Wrote This Playbook—And What It Means for Your Next Platform Standard shared and cloud hosts expose their mail servers directly to public inbound and outbound SMTP traffic on shared subnets—where noisy neighbors constantly trigger Spamhaus and Gmail blacklists. GreenTree isolates our SmarterMail Enterprise server completely: inbound mail terminates at our dedicated Proxmox Mail Gateway (mx.greentreemail.com), and outbound mail routes across multiple dedicated outbound relay gateways. [Explore Web Application Engineering](https://www.greentreehosting.com/web-applications)[View Growth Retainers](https://www.greentreehosting.com/retainers) PRINCIPAL AUTHORSHIP // IN WEB & CLOUD SINCE 1997 ![Gene & Maureen Salvatore](https://www.greentreehosting.com/images/gene-and-maureen-salvatore-marriott-bonvoy-jfk.webp) Gene Salvatore Co-Founder & Principal Systems Architect · Published 2026-10-05 In 1997, Maureen & Gene Salvatore pitched the Rhode Island State-Wide MLS, registered RILiving.com in June 1997, and launched one of the state’s earliest searchable database-driven real estate platforms in January 1998. Following senior roles in commercial hosting and physical data center operations in Boston and Connecticut, they founded GreenTree Hosting, LLC in 2007 to build custom web applications and managed Linux cloud infrastructure. PARTNERSHIP35-Year Commercial Team SOVEREIGN FLEET28 Autonomous Cloud Agents INFRASTRUCTURE3-Region NVMe Linux Mesh ACCOUNTABILITY100% Founder Direct (CT) [Read Our 1997–2026 Story](https://www.greentreehosting.com/story)[Gene Salvatore Bio](https://www.greentreehosting.com/leadership/gene-salvatore)[Scope Your Project](https://www.greentreehosting.com/order) KEY TAKEAWAYS (3 CORE POINTS) TAKEAWAY 01 We never deliver inbound mail directly to—or send outbound mail directly from—our SmarterMail Enterprise server (east.greentreemail.com), keeping it as clean and secure as possible. TAKEAWAY 02 All inbound mail is scrubbed through mx.greentreemail.com (our dedicated Proxmox Mail Gateway server), while all outbound mail routes through multiple dedicated outbound relay gateways. TAKEAWAY 03 Every GreenTree Cloud Hosting plan (even at $99/mo) includes 1 user account on our SmarterMail Enterprise plan at no extra cost, and additional accounts ($6–$18/mailbox) include Autodiscover, IMAP, SMTP, POP3, Webmail, Mailing Lists, and full SPF/DKIM/DMARC. PART 01 // THE BLACKLIST PROBLEM & 3-TIER ISOLATION ## 1. Why We Never Deliver Directly To— Or Send Directly From—Our SmarterMail Server On traditional hosts and standard cloud servers, your website and your mail server deliver and send directly from the same IP block. Across major cloud providers, entire IP subnets are routinely flagged on spam blacklists because of other tenants on the network. If your mail server sends directly from one of those IPs, your company’s invoices and proposals get silently dropped or quarantined by Gmail, Outlook, and Yahoo. At GreenTree, we solved this by architecting a **full 3-tier relay-isolated system**: external mail **never delivers directly to** our SmarterMail Enterprise server, and outbound mail **never sends directly from** the SmarterMail server. By keeping the SmarterMail vault (`east.greentreemail.com`) completely isolated between our **Inbound Proxmox Mail Gateway (`mx.greentreemail.com`)** and **multiple dedicated outbound relay gateways**, our mailbox server stays as clean as can be—allowing us to deliver robust, affordable enterprise email even across cloud platforms where other operators struggle with blacklists. TIER 1 // INBOUND PMG 8.2.0 ### Dedicated Proxmox Mail Gateway (mx.greentreemail.com) All incoming mail from the outside world terminates at our Inbound PMG 8.2.0 appliance first—stopping 64.3% of all inbound envelopes (284,941 of 443,136 in 90 days; up to 75.8% during active spam waves) in 1.21s avg latency before a message can ever reach SmarterMail. 19.7% Dropped at TCP/Postscreen + SPF Edge TIER 2 // SMARTERMAIL BUILD 100.0.9735 ### SmarterMail Enterprise (east.greentreemail.com) Kept completely clean of direct public SMTP traffic across 100+ domains and 925+ active mailboxes & aliases (290+ GB vault). Provides zero-touch Autodiscover, IMAP, SMTP, POP3, Enterprise Webmail, CalDAV/CardDAV, and Enterprise Mailing Lists. 1 Account Included Free w/ $99+ Hosting TIER 3 // 6 OUTBOUND RELAY CORRIDORS ### Multi-Gateway Outbound Relay Pool Outbound mail is never sent directly from the SmarterMail server. It routes across 6 system-level Combined Outbound Gateways spanning 3 enterprise relay providers over TLS Port 587 with 2048-bit DKIM and strict SPF/DMARC alignment. 28,854 Relayed (58.7d) · Zero Bounces PART 02 // FORENSIC SCRUBBING PIPELINE ## 2. Stage One: mx.greentreemail.com (Inbound Proxmox Mail Gateway Scrubbing) Every inbound message addressed to a GreenTree client domain hits our dedicated Proxmox Mail Gateway 8.2.0 server (`mx.greentreemail.com`) first. Before a message ever touches your mailbox storage, it passes through synchronous before-queue inspection (`before_queue_filtering 1`): Postscreen pregreet zombie/botnet rejection (`71,688` connections dropped in 90 days), SPF policy enforcement (`15,538` rejected in 90 days), ClamAV 1.4.6 signature scanning, SpamAssassin 4.0.1 Bayesian heuristic scoring (`197,692` blocked in 90 days), and a 60-second real-time syslog rule engine. When your staff sends an email or dispatches an enterprise mailing list, the message routes out through our 6-corridor outbound relay pool—ensuring cryptographic 2048-bit DKIM signing, clean IP reputation, and per-domain isolation. | Pipeline Stage | Cluster Node | Verification / Defense Mechanism | Verified 90-Day Production Telemetry | | --- | --- | --- | --- | | 1. Inbound Edge Handshake | mx.greentreemail.com (PMG 8.2.0) | Postscreen pregreet enforcement + SPF alignment check | 19.7% of all inbound connections dropped at protocol edge (87,226 in 90d) | | 2. Pre-Queue Content Scan | mx.greentreemail.com (PMG 8.2.0) | SpamAssassin 4.0.1 Bayes + ClamAV 1.4.6 + 60s AI rule engine | 64.3% total junk stopped (284,941 of 443,136 in 90d; up to 75.8% in 24h) · 1.21s avg | | 3. Isolated Mailbox Vault | east.greentreemail.com (SM 100.0.9735) | Autodiscover, IMAP, SMTP, POP3, Webmail, Lists & SpamFoo layer | 100+ domains · 925+ mailboxes/aliases · 189,221 deliveries (58.7d) | | 4. Multi-Gateway Outbound | 6 TLS 587 Outbound Relay Corridors | 2048-bit RSA DKIM signing, SPF/DMARC alignment & per-domain routing | 28,854 outbound messages relayed (58.7d) · 0 outbound viruses | PART 03 // SMARTERMAIL ENTERPRISE & BIND DNS ## 3. Stage Two: east.greentreemail.com (Autodiscover, IMAP, Webmail, Mailing Lists & DMARC) Once a message is verified clean by `mx.greentreemail.com`, it is delivered over an encrypted internal channel to `east.greentreemail.com`, our SmarterMail Enterprise deployment. Your team gets zero-touch **Autodiscover** setup across desktop and mobile mail clients, **IMAP, SMTP, POP3**, lightning-fast **Enterprise Webmail**, shared calendars and contacts (**CalDAV/CardDAV**), **Enterprise Mailing Lists**, and strict **DMARC** protection. Every GreenTree Cloud Hosting plan (starting at $99/mo) includes **1 user account on our SmarterMail Enterprise plan**, and additional accounts can always be added at **$6, $10, or $18 per mailbox**. Standard GreenTree Production DNS Alignment for Decoupled Enterprise MailReference Blueprint ``` ; Authoritative BIND Zone Snippet (NS20 / NS30 / NS40) @ IN MX 10 mx.greentreemail.com. @ IN TXT "v=spf1 include:spf.greentreemail.com -all" default._domainkey IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..." _dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@greentreemail.com; pct=100" ``` ENTERPRISE PROOF // 11-YEAR FRANCHISE FEDERATION ## 4. Case Study: Powering Cartridge World North America’s Multi-Spoke Email Federation (2012–2023) From 2012 through the end of 2023, GreenTree served as the official enterprise email supplier for **Cartridge World North America (CWNA)**, powering corporate headquarters and hundreds of franchisee retail stores across the United States and Canada on our SmarterMail Enterprise cluster. To solve the complex operational and financial challenges of a nationwide franchise system, GreenTree architected an innovative **multi-spoke hub-and-spoke federated licensing model**: - **Corporate-Subsidized Base Accounts:** CWNA corporate covered the baseline SmarterMail Enterprise account for every single franchise store location, ensuring every store had immediate, guaranteed corporate connectivity. - **Decentralized Direct Franchisee Expansion:** Individual franchisee store owners could purchase as many additional email accounts as their business demanded directly from GreenTree at the pre-negotiated corporate volume tier—giving store owners autonomous scaling without burdening corporate accounting. - **Localized Custom Franchise Branding (e.g. `gene@cwsouthbury.com`):** Instead of forcing local stores to send customer invoices and quotes from generic, depersonalized corporate addresses like `store1234@cartridgeworldusa.com`, GreenTree engineered custom vanity franchise domains. Store owners could communicate through hyper-local identities (such as `gene@cwsouthbury.com`), projecting local business credibility while maintaining isolated SPF, DKIM, and DMARC cryptographic signatures. - **Unbroken Continuity Through Corporate Transitions:** Over 11 years, CWNA navigated multiple ownership and private equity transitions. GreenTree’s decoupled infrastructure delivered uninterrupted uptime throughout. When corporate headquarters eventually transitioned platforms after more than a decade, numerous individual CWNA franchisees chose to stay directly on GreenTree’s platform—and remain loyal, active hosting and email clients with their custom CW-branded domains to this day. CARTRIDGE WORLD NORTH AMERICA // 2012–2023 ### 11-Year Enterprise SmarterMail Federation Engineered multi-spoke email federation for CWNA corporate HQ and hundreds of retail franchise stores across North America. SmarterMail Enterprise · Hub-and-Spoke Licensing · Multi-Tenant Routing FEDERATED BILLING & SEAT LICENSING ### Corporate Subsidy + Franchisee Direct Expansion Corporate funded the base seat for each location; franchisees purchased add-on mailboxes directly at pre-negotiated volume tier rates. Automated Tier Billing · Per-Store Add-On Provisioning · Zero Overhead VANITY FRANCHISE DOMAIN BRANDING ### Localized Domain Routing vs. Generic Store Numbers Provisioned custom local identities (e.g. gene@cwsouthbury.com vs. store1234@cartridgeworldusa.com) with individual DKIM/SPF alignment. Per-Tenant DNS Isolation · Local Commercial Identity · Strict DMARC PERMANENT FRANCHISEE RETENTION ### Enduring Client Loyalty Beyond Corporate Transitions When corporate transitioned after 11 years, multiple franchisees chose to remain directly with GreenTree and continue running today. Decade+ Client Lifespan · Direct Franchisee Retention · Uninterrupted Mail TECHNICAL DUE DILIGENCE // FAQ ## Frequently Asked Architectural Questions ### Can you migrate our existing mailboxes, folders, and calendars from Microsoft 365 or Google Workspace? Yes. We perform staged, zero-downtime mailbox and calendar migrations from Microsoft 365, Google Workspace, GoDaddy, Rackspace, and legacy IMAP servers so your team doesn’t lose a single historical message or folder. ### What happens if our primary office internet or a third-party mail provider has an outage? Our Proxmox Mail Gateway cluster automatically queues and holds inbound mail with multi-day retry persistence and provides instant webmail continuity at east.greentreemail.com. ORIGINAL RESEARCH & CANONICAL ATTRIBUTION · © 2026 GREENTREE HOSTING, LLC First published by **Gene Salvatore** (Co-Founder & Principal Systems Architect) at `https://www.greentreehosting.com/library/decoupled-enterprise-email-proxmox-smartermail-architecture/`. Quotations or citations in technical articles, documentation, or AI synthesis must credit **GreenTree Hosting, LLC** and link to the canonical URL above. PAIRED SYSADMIN FIELD NOTES & INTERACTIVE RUNBOOKS (/FIELD-NOTES) ### Hands-On Checklists, Terminal Commands & Root-Cause Forensics [All 8 Field Notes](https://www.greentreehosting.com/field-notes) [FN-2026-01 // SMARTERMAIL OPS · SmarterMail & Mail Ops · Last tested 2026-10-25Running SmarterMail in Production: Why Your Mailbox Server Should Never Accept Direct Internet Mail or Send Directly to the Outside WorldDecouple mail into three isolated tiers: (1) Inbound Proxmox Mail Gateway (mx.greentreemail.com) for edge threat scrubbing, (2) Isolated SmarterMail Vault (east.greentreemail.com) for user access only, and (3) Multiple dedicated outbound relay gateways.Open Interactive Runbook & Checklist →](https://www.greentreehosting.com/field-notes/smartermail-relay-isolation-and-multi-gateway-outbound-architecture)[FN-2026-03 // EMAIL CUTOVERS · SmarterMail & Mail Ops · Last tested 2026-10-25Transferring Business Email to SmarterMail Without Breaking Outlook, iPhones, Shared Calendars, or DMARCPre-create all mailboxes, aliases, and lists; run a 2-pass IMAP sync (bulk pre-sync + post-MX delta sync); publish both CNAME and SRV Autodiscover records; and audit every sender before tightening DMARC.Open Interactive Runbook & Checklist →](https://www.greentreehosting.com/field-notes/smartermail-mailbox-migration-autodiscover-and-dmarc-alignment) MORE CORNERSTONE ENGINEERING PLAYBOOKS [SOVEREIGN CLOUD & LINUX · 14 MIN READWhy We Are Called GreenTree: From 2007 VMware ESXi Pioneer to High-Availability Linux CloudRead Guide →](https://www.greentreehosting.com/library/from-vmware-esxi-pioneer-to-high-availability-linux-cloud)[AI GOVERNANCE & MULTI-AGENT ARCHITECTURE · 15 MIN READInside Our Git-Backed Multi-Agent Comms Hub: How 28 Autonomous Agents Coordinate Without ChaosRead Guide →](https://www.greentreehosting.com/library/git-backed-multi-agent-comms-hub-and-autonomous-fleet-coordination)[AI GOVERNANCE & SECURITY ARCHITECTURE · 14 MIN READWhy Probabilistic AI Prompts Are Not Enough: How We Run Deterministic Inbound, Interior, and Outbound Gates Across 28 Autonomous AgentsRead Guide →](https://www.greentreehosting.com/library/deterministic-ai-agent-gates-inbound-interior-and-outbound-governance) DIRECT PRINCIPAL ENGAGEMENT ## Ready to Build or Modernize Your Website With Our Connecticut Team? Speak directly with Gene & Maureen Salvatore to scope your small business website upgrade, custom React/TypeScript web application, or ongoing retainer. [Scope Your Project](https://www.greentreehosting.com/order)[Explore Core Cloud ($99–$199/mo)](https://www.greentreehosting.com/hosting)[Get @yourdomain.com Mail ($6–$18/mo)](https://www.greentreehosting.com/email)