Sendmail behind NAT load balancer

[crcal...@ucdavis.edu]

We have long been scaling out our mail routing servers (a whole pool of systems behind the name to which we MX our domains) using the "direct server return" architecture. Under this model, Sendmail sees the actual IP addresses of the clients, so features such as the access DB, RBLs, greylisting, IP reputation analysis, etc. are available to us.

However, the network people are pushing to replace the existing load balancing architecture with a NAT load balancer. Thus, all connections would appear to Sendmail to be originating from the load balancer device, rather than the remote host actually opening the connection.

I haven't actually been involved in day-to-day email operations in a number of years, so I apologize if this is a stupid question, but: is there any equivalent of the HTTP protocol's X-Forwarded-For or X-Client-IP header technology available in ESMTP nowadays? I've done a bit of searching and have found reference to an XCLIENT verb, but that seems to be peculiar to Postfix. What approaches do others take when faced with such an architecture? Thanks in advance for any suggestions.

[David F. Skoll]

crcal...@ucdavis.edu wrote:

> However, the network people are pushing to replace the existing load
> balancing architecture with a NAT load balancer. Thus, all connections
> would appear to Sendmail to be originating from the load balancer
> device, rather than the remote host actually opening the connection.

A good NAT load balancer will preserve the original IP address
as the source IP address and just rewrite the destination address.
Even Linux's iptables can do that. Don't buy a load balancer if
it obscures the external IP.

> is there any equivalent of the HTTP protocol's X-Forwarded-For or
> X-Client-IP header technology available in ESMTP nowadays?

Nope.

Regards,

David.

[David F. Skoll]

Sorry to follow up on myself...

David F. Skoll wrote:

> A good NAT load balancer will preserve the original IP address
> as the source IP address and just rewrite the destination address.
> Even Linux's iptables can do that. Don't buy a load balancer if
> it obscures the external IP.

Even if you go with a load balancer, I recommend you still publish two
or three MX records. If the load balancer gets unlucky and picks a
dead or overloaded back-end server, you'll want the SMTP client to retry.
If it appears that you have only one MX record with one IP address, the
client won't retry right away, but will queue the mail. This could cause
delays.

Regards,

David.

[crcal...@ucdavis.edu]

> A good NAT load balancer will preserve the original IP address
>
> as the source IP address and just rewrite the destination address.
>
> Even Linux's iptables can do that. Don't buy a load balancer if
>
> it obscures the external IP.

Thanks for the response, David; I'll press them on this point. (BTW, MIMEDefang is a critical part of our infrastructure here. Thank you!)