Deployment of a D2S Gateway Server

Enterprise Edition  >  SMTP Gateway Server  >  Deployment

This technical document describes the basic types of deployment architecture appropriate for integrating a Death2Spam server into an enterprise email system.

Basic Configuration

In the most simple configuration, Death2Spam is installed between the firewall and the final Mail Transfer Agent (MTA), e.g. Sendmail. The Primary MX record for this configuration points through the firewall to the D2S server, and the D2S server is configured to pass mail on to the final MTA (configured via the smtp-proxy.config file).

DMZ Configuration

There are numerous ways to configure Death2Spam for use with a Demilitarized Zone (DMZ). A DMZ configuration involves multiple firewalls, adding layers of extra security between the Internet and a company's business logic and data storage. In the simplest configuration, mail servers in the DMZ collect inbound mail, limiting it to only valid mail for the company's domain -- attempts to relay to other domains are blocked at this point. The mail servers in the DMZ are hardened such that they only listen for mail connections.

Mail received in this way is forwarded from the DMZ servers to the D2S server for processing. Both the primary and secondary SMTP servers can reside in the DMZ, and may be configured to retain mail in the event that the D2S server becomes unreachable.

Single Machine Configuration

Whilst single-machine is the least expensive configuration, it is not as straightforward to setup. This configuration is ideal for small installations, where the mail server sits astride the firewall, but it is not necessary for the machine to be on the firewall itself (which can be a security hazard). In order for this configuration to work, the machine in question must have 2 IP addresses, and preferably 2 host names.

One of the IP addresses is allocated for external communications, and the D2S system is configured to use this IP address. The external MX record for the domain is configured to direct mail at this host.

The second IP address is allocated to your mail application. Your mail server should be configured to listen only on this address (most mail applications will by default attempt to listen on all addresses). All internal clients should be configured to send mail via this application. In addition, the D2S server is configured to forward mail direct to the mail application via the second IP address.

It is not necessary for the firewall to reside on the same machine, and usual practice will be to place the firewall on its own machine. However, Death2Spam will work just as well in this configuration as with a separate firewall. In any case, the firewall should not prevent external access to the mail application -- it should be configured to forward all external mail to the D2S server for filtering.

Other Configurations

For advanced configurations, there is an almost limitless number of ways of configuring the Death2Spam server. Here are some examples and tips:

Single Machine using Firewall NAT

An advanced firewall with Network Address Translation can be used to create a single machine configuration utilizing only one IP address:

1. Configure the Death2Spam smtp.config file such that Death2Spam listens on a non-standard port number, for example 2525.
2. Configure NAT on your firewall such that all mail from external sources is redirected to port 2525 on the machine where Death2Spam runs.
3. Configure your mail application as per normal, listening on the normal SMTP port (25).
4. Configure Death2Spam to forward all mail to the normal port on the same machine.

Running D2S as a Non-Privileged User (Unix)

You can configure D2S to run as a non-privileged user by configuring it to listen on non-privileged ports (using smtp.config and httpd.config). You can then use network address translation on a firewall device to redirect mail traffic to the non-privileged ports (see Single machine using Firewall Network Address Translation for more information).

Configuring External Secondary Mail Servers to use D2S

If you have more than one MX record, but only one primary mail server, you can configure the secondary mail servers to use Death2Spam. This configuration assumes the secondary servers are operating in a store-and-forward capacity, collecting mail while the primary mail server is off-line, and then forwarding it to the primary server when it comes online again.

For this configuration:

• Your primary MX record should point to the Death2Spam server.
• Your secondary MX record should point to your backup server as per normal.
• Your secondary server should be configured to forward mail to the D2S server. The Death2Spam server will return an 4xx error message if the primary server is not running, indicating that the secondary server should try again later.