Running SmarterMail in Production: Why Your Mailbox Server Should Never Accept Direct Internet Mail or Send Directly to the Outside World
After decades of running commercial email servers, the single biggest mistake we see on self-hosted SmarterMail, Exchange, and control-panel mail servers is letting the mailbox server talk directly to the public internet on port 25. Here is how our 3-tier relay-isolated architecture keeps client inboxes clean and outbound mail out of spam folders.
Legitimate company emails start bouncing or landing in Gmail/Outlook Junk folders, or the SmarterMail server CPU spikes during inbound spam waves and dictionary attacks.
The SmarterMail mailbox server is exposed directly as the public MX host and sends outbound mail directly from its own IP—so a single noisy forwarder, compromised password, or botnet flood tarnishes the server IP.
Decouple mail into three isolated tiers: (1) Inbound Proxmox Mail Gateway (mx.greentreemail.com) for edge threat scrubbing, (2) Isolated SmarterMail Vault (east.greentreemail.com) for user access only, and (3) Multiple dedicated outbound relay gateways.
Interactive SmarterMail Production Hardening Checklist
Check off each item to audit your own SmarterMail or business mail server against our production standard:
1. Why Running Inbound MX, Mailbox Storage, and Outbound SMTP on One IP Eventually Breaks
SmarterMail is one of the finest commercial email platforms ever written—fast, clean, free of per-seat bloatware tax, and rock-solid on storage. We have run it for years. But when someone installs SmarterMail on a single server, points their MX record straight at that server’s IP, and lets that same IP send outbound mail directly to Gmail, Microsoft 365, and Yahoo, they are setting a trap for themselves.
On the public internet, port 25 is hit around the clock by botnets testing dictionary wordlists, sending malformed MIME payloads, and probing for open relays. If your mailbox server handles that raw port 25 traffic directly, its CPU and disk I/O spend half the day fighting junk instead of serving your team’s Outlook, iPhone, and Webmail sessions.
Even worse is the outbound side: if one user on a single-box mail server sets up an external auto-forwarder to a personal address—and a spam message gets forwarded out—the receiving provider sees your SmarterMail IP forwarding spam and places that IP on a blocklist. Instantly, every customer on that server has their legitimate invoices and proposals rejected.
| Mail Layer | Typical Single-Server Mail Setup | GreenTree 3-Tier Relay-Isolated Architecture |
|---|---|---|
| Inbound Port 25 (MX) | Public internet connects directly to the mailbox server | Terminates at Proxmox Mail Gateway (mx.greentreemail.com) for 8-stage scrubbing |
| Mailbox Storage & Sync | Shares CPU, RAM, and IP reputation with raw SMTP traffic | Isolated SmarterMail Enterprise vault (east.greentreemail.com) for authenticated users only |
| Outbound Delivery | Sent directly from the mailbox server IP (single point of RBL failure) | Routed across multiple dedicated outbound relay gateways with automatic health monitoring |
| Compromised Account Containment | Can blacklist the entire server before an admin notices | Per-mailbox hourly rate limits + outbound gateway anomaly detection |
2. How We Structure Inbound PMG, Isolated SmarterMail, and Multi-Gateway Outbound Delivery
In our production email environment (east.greentreemail.com, running SmarterMail Enterprise Build 100.0.9735 behind Proxmox Mail Gateway 8.2.0 on mx.greentreemail.com), we separate email into three distinct jobs so no single failure mode can cross over:
• Tier 1 — Inbound Edge Scrubbing (mx.greentreemail.com · PMG 8.2.0): Every domain we host points its MX record to our Proxmox Mail Gateway appliance (Kernel 6.8.12-43-pve, SpamAssassin 4.0.1-2, ClamAV 1.4.6, local Unbound resolver). Across our last 90-day production window (443,136 inbound envelopes / 126,916 in the last 30 days), 284,941 junk and malicious messages (64.30%, and up to 75.79% during peak 24-hour spam waves) were stopped at the perimeter before ever reaching SmarterMail. Postscreen pregreet enforcement (71,688 botnet drops in 90d) and SPF rejection (15,538 in 90d) terminate 19.7% of all inbound connections at the TCP/protocol handshake before content scanning, with an average full-inspection latency of 1.21 seconds.
• Tier 2 — The Isolated SmarterMail Vault (east.greentreemail.com · Build 100.0.9735): Because the gateway handles the front door, SmarterMail only serves authenticated users (across 100+ primary domains, 925+ active mailboxes & aliases, and 290+ GB of live mailbox storage) and our internal gateway transport (189,221 messages delivered over the last 58.7-day uptime window, with SpamFoo secondary vault filtering catching an additional 11,033 low/medium/high spam messages).
• Tier 3 — 6-Corridor Multi-Provider Outbound Relay Pool: When a user hits Send in Outlook, Apple Mail, or Webmail, SmarterMail routes that message out across 6 system-level Combined Outbound Gateways spanning 3 independent enterprise relay providers over TLS Port 587 (plus per-domain outbound corridors)—relayed with 100% 2048-bit RSA DKIM signing, non-destructive SPF alignment, and strict DMARC enforcement (28,854 remote outbound messages relayed over the last 58.7 days with zero outbound virus incidents).
; GreenTree Hosting, LLC — Reference SmarterMail DNS Records ; 1. Inbound MX points strictly to the Proxmox Mail Gateway (never the mailbox store) @ IN MX 10 mx.greentreemail.com. ; 2. Autodiscover points clients (Outlook / iOS / Apple Mail) to the SmarterMail Vault autodiscover IN CNAME east.greentreemail.com. _autodiscover._tcp IN SRV 0 0 443 east.greentreemail.com. ; 3. SPF authorizes only our outbound relay gateways (-all hard fail) @ IN TXT "v=spf1 include:spf.greentreemail.com -all" ; 4. 2048-bit DKIM public key & DMARC policy default._domainkey IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..." _dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@greentreehosting.com; pct=100; adkim=s; aspf=s"
Common Questions on SmarterMail 3-Tier Relay Isolation
Why shouldn’t my MX record point directly to mail.mydomain.com on the SmarterMail server?
When your MX record points directly to the mailbox server, spammers and botnets hammer your mailbox server’s CPU and disk directly on port 25. Placing a dedicated Proxmox Mail Gateway (mx.greentreemail.com) in front of SmarterMail blocks malware, phishing, and botnets at the network edge before they ever reach your mailbox storage.
What happens if an external mail provider temporarily throttles or blocks an outbound IP?
Because SmarterMail sends outbound mail through our pool of dedicated outbound relay gateways rather than from a single static server IP, we can route traffic across healthy relay gateways immediately without touching client DNS records or reconfiguring user devices.
Does forwarder spam affect outbound IP reputation on SmarterMail?
Yes—unfiltered external auto-forwarders are one of the most common causes of IP blacklisting on traditional mail servers. By scrubbing inbound mail through Proxmox Mail Gateway first and enforcing SRS/DKIM and rate limits on outbound relays, we prevent forwarded spam from poisoning outbound delivery.
Inside Our 3-Tier Enterprise Email Architecture: Inbound PMG, SmarterMail Enterprise & Multi-Gateway Outbound
Read the full 3,500+ word architectural breakdown of how our Proxmox Mail Gateway and SmarterMail Enterprise stack compares against per-seat Microsoft 365 and Google Workspace.
Want Your Domain on Our 3-Tier Proxmox + SmarterMail Stack?
Every $99/mo Core Cloud and $199/mo Core Cloud + Management hosting plan includes 1 SmarterMail Enterprise mailbox free. Additional mailboxes are $6/mo (25 GB Core), $10/mo (50 GB Business & Lists), or $18/mo (100 GB Executive Vault)—and existing customers keep their grandfathered rates.
Related Notes From the Sysadmin Desk
Transferring Business Email to SmarterMail Without Breaking Outlook, iPhones, Shared Calendars, or DMARC
Pre-create all mailboxes, aliases, and lists; run a 2-pass IMAP sync (bulk pre-sync + post-MX delta sync); publish both CNAME and SRV Autodiscover records; and audit every sender before tightening DMARC.
Authoritative BIND DNS in the Real World: Why Secondary Nameservers Serve Stale TTLs (And How to Catch Zone Drift in 60 Seconds)
Always increment the YYYYMMDDnn SOA serial before rndc reload, strip stale per-record TTL overrides, align registrar glue/NS records with the zone, and query every delegated nameserver directly.
The Zero-Downtime Server Transfer Runbook: How We Move Live Websites, Databases, and Mailboxes Without Losing a Single Order or Email
Execute a 5-stage cutover: lower DNS TTLs to 60 seconds 48 hours early, stage and test via local hosts-file override, pre-issue TLS certificates, run a final sub-second rsync + database delta sync, and enforce a 5-source 301 redirect map.