mail routing and NAT

feike used Ask the Experts™
We have 1 webserver (cobalT0 and on mailserver with several domains.
all servers, including the linux server are behind
a FW with NAT configured.

When from a website on the cobalt we send email to an internal domain, via sendmail, it tries to connect for the external ip adres of th FW.

We added domains to the hosts and lmhosts files
telnet and ip works fine it uses the internal adres.

However sendmail still resolves using the public DNS.

with regards,


Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2005
That's because the MTA is using what the MX record defines as the mail server for those domains. The straight forward solution is to use split DNS. That means that you set up a DNS server that defines the same host/domain names on the inside of the firewall, but uses inside IP's. Normally one would configure that DNS server to forward all non-local requests to your Internet accessible DNS server.

Once you have the private DNS server operational you then configure all inside hosts, including he Cobalt, to use that DNS. Since the MX record, as seen from the inside, points to the inside IP of your mail server(s) mail to domains you host won't go to outside IP's.
...though if the hosts pointed to by the MX records exits in the /etc/hosts file (on the Cobalt) you should be able to direct mail to the internal MTA instead of the firewall.
If sendmail is configured to use a relay server, the relay server needs the /etc/hosts editing done.
Depending on how many hosts you need to setup, the split DNS solution may be preferred.
Note that you should not add 'domains' to /etc/hosts but the actual MTA's (the host/ip pointed to by MX records in the DNS)
(The lmhosts file should not have to be involved, and wouldn't exist on a Unix server)

If sendmail were to be configured to use an/the internal MTA as relay, that's all you have to do.

This old question needs to be finalized -- accept an answer, split points, or get a refund.  For information on your options, please click here-> http:/help/closing.jsp#1 
Post your closing recommendations!  No comment means you don't care.
Top Expert 2005

my comment provides a viable solution.
No comment has been added lately, so it's time to clean up this TA.
I will leave a recommendation in the Cleanup topic area that this question is to:

Points split between jlieve and bummerlord

Please leave any comments here within the next seven days.


EE Cleanup Volunteer

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial