MX记录,更好的设置以实现负载平衡和故障转移


9

以域example.com为例,它有两个已经配置的邮件服务器mail1.example.com和mail2.example.com,通常我会使用以下设置:

example.com.           1200    IN      MX      10 mail1.example.com.
example.com.           1200    IN      MX      10 mail2.example.com.
mail1.example.com.     1200    IN      A       172.16.10.1
mail2.example.com.     1200    IN      A       172.16.10.2

一位同事建议进行以下设置:

example.com.           1200    IN      MX      10 mail.example.com.
mail.example.com.      1200    IN      A       172.16.10.1
mail.example.com.      1200    IN      A       172.16.10.2

mail1.example.com.     1200    IN      A       172.16.10.1
mail2.example.com.     1200    IN      A       172.16.10.2

一个新的主机名带有指向两个服务器的两个A记录,因为他指出某些客户端不能正确地使用相同优先级MX进行轮询,因此这应该是合法的设置,但它仍正确支持故障转移,例如172.16。 10.1失败,是否正在尝试172.16.10.2进行交付?或者像这样的设置会更好:

example.com.           1200    IN      MX      10 mail.example.com.
example.com.           1200    IN      MX      20 mail1.example.com.
example.com.           1200    IN      MX      20 mail2.example.com.
mail.example.com.      1200    IN      A       172.16.10.1
mail.example.com.      1200    IN      A       172.16.10.2

mail1.example.com.     1200    IN      A       172.16.10.1
mail2.example.com.     1200    IN      A       172.16.10.2

谢谢。

Answers:


11

指定MTA应该如何处理MX记录的RFC是RFC974RFC1123第5.3.4节RFC2821第5节RFC5321第5节

RFC974状态现在为HISTORIC。据此,MTA希望查询与域关联的MX记录的列表,并被“鼓励”以优先级升序尝试所有(或固定数量的)SMTP服务器。如果有多个具有相同首选项值的MX记录,则MTA必须尝试将邮件传递到所有SMTP服务器,直到成功为止。尝试的顺序是MTA的选择,也就是说,RFC并不决定是否必须随机联系SMTP服务器或以DNS服务器给定的顺序联系SMTP服务器。此外,RFC并没有规定如何处理引用多个A记录的MX寄存器。

(...) If the list of MX RRs is not empty, the mailer should try to deliver
the message to the MXs in order (lowest preference value tried
first). The mailer is required to attempt delivery to the lowest
valued MX. Implementors are encouraged to write mailers so that they
try the MXs in order until one of the MXs accepts the message, or all
the MXs have been tried. A somewhat less demanding system, in which
a fixed number of MXs is tried, is also reasonable. Note that
multiple MXs may have the same preference value. In this case, all
MXs at with a given value must be tried before any of a higher value
are tried. In addition, in the special case in which there are
several MXs with the lowest preference value, all of them should be
tried before a message is deemed undeliverable. (...)

RFC1123状态为INTERNET STANDARD。第5.3.4节旨在“完善”关于如何处理MX记录的RFC974过程。现在,它要求MTA以优先级升序尝试所有SMTP服务器,直到一个成功为止。但是,它仍然允许尝试次数的可配置限制。如果有多个具有相同首选项值的MX记录,则RFC建议(但不要求)MTA随机选择一个记录。但是,如果一个MX记录引用了多个A记录(IPv4地址),则RFC要求MTA按照DNS服务器指定的顺序联系所有这些地址,直到一个成功为止。

(...) When it succeeds, the mapping can result in a list of
alternative delivery addresses rather than a single address,
because of (a) multiple MX records, (b) multihoming, or both.
To provide reliable mail transmission, the sender-SMTP MUST be
able to try (and retry) each of the addresses in this list in
order, until a delivery attempt succeeds. However, there MAY
also be a configurable limit on the number of alternate
addresses that can be tried. In any case, a host SHOULD try at
least two addresses.

The following information is to be used to rank the host
addresses:

(1) Multiple MX Records -- these contain a preference
indication that should be used in sorting. If there are
multiple destinations with the same preference and there
is no clear reason to favor one (e.g., by address
preference), then the sender-SMTP SHOULD pick one at
random to spread the load across multiple mail exchanges
for a specific organization; note that this is a
refinement of the procedure in [DNS:3].

(2) Multihomed host -- The destination host (perhaps taken
from the preferred MX record) may be multihomed, in which
case the domain name resolver will return a list of
alternative IP addresses. It is the responsibility of the
domain name resolver interface (see Section 6.1.3.4 below)
to have ordered this list by decreasing preference, and
SMTP MUST try them in the order presented.

(...)

[DNS:3] "Mail Routing and the Domain System," C. Partridge, RFC-974,
January 1986.

RFC2821状态为PROPOSED STANDARD。该RFC淘汰了RFC974,并且在MX记录处理的范围内,它与RFC1123略有不同。前者需要在多个具有相同首选项值的MX记录中随机选择一个SMTP服务器,而后者只是推荐它。

(...) Multiple MX records contain a preference indication that MUST be used
in sorting (see below). Lower numbers are more preferred than higher
ones. If there are multiple destinations with the same preference
and there is no clear reason to favor one (e.g., by recognition of an
easily-reached address), then the sender-SMTP MUST randomize them to
spread the load across multiple mail exchangers for a specific
organization.

The destination host (perhaps taken from the preferred MX record) may
be multihomed, in which case the domain name resolver will return a
list of alternative IP addresses. It is the responsibility of the
domain name resolver interface to have ordered this list by
decreasing preference if necessary, and SMTP MUST try them in the
order presented. (...)

RFC5321状态为DRAFT STANDARD。该RFC淘汰了RFC2821,并且在DNS解析的背景下,它基本上重写了相同的服务器查找过程,并提供了一个新的部分,该部分略微讨论了引用IPv6地址的MX记录的处理。

(...) When a domain name associated with an MX RR is looked up and the
associated data field obtained, the data field of that response MUST
contain a domain name. That domain name, when queried, MUST return
at least one address record (e.g., A or AAAA RR) that gives the IP
address of the SMTP server to which the message should be directed.

(...) When the lookup succeeds, the mapping can result in a list of
alternative delivery addresses rather than a single address, because
of multiple MX records, multihoming, or both. To provide reliable
mail transmission, the SMTP client MUST be able to try (and retry)
each of the relevant addresses in this list in order, until a
delivery attempt succeeds.

(...)  MX records contain a preference indication that MUST be used in
sorting if more than one such record appears (see below). Lower
numbers are more preferred than higher ones. If there are multiple
destinations with the same preference and there is no clear reason to
favor one (e.g., by recognition of an easily reached address), then
the sender-SMTP MUST randomize them to spread the load across
multiple mail exchangers for a specific organization.

The destination host (perhaps taken from the preferred MX record) may
be multihomed, in which case the domain name resolver will return a
list of alternative IP addresses. It is the responsibility of the
domain name resolver interface to have ordered this list by
decreasing preference if necessary, and the SMTP sender MUST try them
in the order presented. (...)

我猜想现代邮件传输代理至少遵循RFC2821或RFC5321程序,因此所有三个DNS设置都提供故障转移功能。但是,只有第一个设置可以提供更好的负载平衡。如果尝试第二种或第三种设置,则必须确保DNS服务器以随机顺序传递响应。此外,DNS记录可能由MTA本身或递归DNS服务器缓存,因此无法保证随机性。我认为mail1.example.com将收到大多数邮件。

使我对第二和第三种设置产生反对的另一个原因是,多个名称引用了一个IP地址。互联网上的邮件服务器通常会拒绝来自映射IP address => PTR => hostname => A => IP address不匹配的主机的邮件(后缀限制reject_unknown_client_hostname也是如此),因此您在设置PTR记录时必须格外小心。

不按随机顺序尝试MX记录的客户端已经违反了RFC2821和RFC5321标准。因此,我认为不能保证这些客户端也会自动尝试辅助IP地址。因此,我更喜欢最简单的DNS配置:

example.com.           1200    IN      MX      10 mail1.example.com.
example.com.           1200    IN      MX      10 mail2.example.com.
mail1.example.com.     1200    IN      A       172.16.10.1
mail2.example.com.     1200    IN      A       172.16.10.2

编辑:添加了对RFC1123的引用。


谢谢您提供详细的参考资料,也许我们期望在没有合适的负载均衡器的情况下过高,正如Marki所说:您也有关于PTR的要点,不匹配可能会引起问题,应谨慎对待。
Krdan '16

2

第二种设置不支持故障转移。假设mail.example.com已解析为172.16.10.1,但失败。然后,由于只有一个MX记录,因此不会尝试172.16.10.2。

第三种设置产生的DNS流量是第一种的两倍。除了流量之外,它们两个都有相同的行为:正如您所说的,某些客户端将无法正确地使用相同优先级MX进行轮询。

为了兼顾负载平衡和故障转移,我将尝试:

example.com.           1200    IN      MX      10 mail1.example.com.
example.com.           1200    IN      MX      10 mail2.example.com.
example.com.           1200    IN      MX      20 mail3.example.com.
example.com.           1200    IN      MX      30 mail4.example.com.
mail1.example.com.     1200    IN      A       172.16.10.1
mail2.example.com.     1200    IN      A       172.16.10.2
mail3.example.com.     1200    IN      A       172.16.10.1
mail4.example.com.     1200    IN      A       172.16.10.2
  • 10条MX记录------>某种负载平衡
  • 20、30 MX记录->故障转移

1

我认为您的第一个设置是正确的。原因如下:

  1. 您有2个具有相同优先级的MX记录,这对负载平衡非常有用。RFC5321指出SMTP服务器需要为所有具有相同优先级的服务器随机分配负载

  2. 如您所述,循环A记录将无法正确进行故障转移。这称为多宿主A记录,发件人将向DNS响应上的第一个A条目发送邮件,而DNS服务器确定列表返回的顺序。因此,如果您需要负载分配或故障转移,则需要DNS服务器可以执行此操作(健康和负载监控器)。再次基于RFC,所有发件人都需要首先在MX记录上尝试具有相同优先级的所有服务器,因此您可以对两个MX记录进行故障转移。

参考:https : //tools.ietf.org/html/rfc5321第69页


0

对于故障转移,请执行以下操作:

example.com.           1200    IN      MX      10 mail1.example.com.
example.com.           1200    IN      MX      20 mail2.example.com.
mail1.example.com.     1200    IN      A       172.16.10.1
mail2.example.com.     1200    IN      A       172.16.10.2

MTA将首先尝试mail1,然后尝试mail2。

真正不可能将负载平衡和故障转移结合在一起。您可以这样做:

example.com.           1200    IN      MX      10 mail1.example.com.
example.com.           1200    IN      MX      20 mail2.example.com.
mail1.example.com.     1200    IN      A       172.16.10.1
mail1.example.com.     1200    IN      A       172.16.10.2    
mail2.example.com.     1200    IN      A       172.16.10.1
mail2.example.com.     1200    IN      A       172.16.10.2

MTA将首先尝试mail1,该时间的一半指向.1,另一半指向2.。这里的问题是在无法访问mail1的情况下,mail2可能指向与mail1相同的地址。

所以你也可以尝试

example.com.           1200    IN      MX      10 mail1.example.com.
example.com.           1200    IN      MX      10 mail2.example.com.
example.com.           1200    IN      MX      20 mail2.example.com.
example.com.           1200    IN      MX      20 mail1.example.com.
mail1.example.com.     1200    IN      A       172.16.10.1
mail1.example.com.     1200    IN      A       172.16.10.2    
mail2.example.com.     1200    IN      A       172.16.10.1
mail2.example.com.     1200    IN      A       172.16.10.2

降低初始连接不起作用的风险。风险仍然不会为零。但是,MTA稍后将重新尝试连接。

为了有效执行任务关键的负载平衡和故障转移,请组装或组合一个负载平衡器(集群)。


我完全不同意Marki。我仍然可以使用相同优先级的MX记录进行故障转移和负载平衡。我在生产环境中使用过它,效果很好
Gk。

OP表示,他们怀疑同一个prio MX是否可用于负载平衡。在这种情况下,他们应该购买负载平衡器:)
Marki

-1

这取决于您拥有的邮件服务器。我们有一个名为reddoxx的邮件服务器-它仅使用第一个mx记录。(具有相同优先级)仅当第一个mx没有响应时,它才会连接到第二个mx,依此类推。我们的邮件服务器只是忽略RFC5321


1
那么,使用与OP描述相同名称的两个A记录将如何处理?
小鸡
By using our site, you acknowledge that you have read and understand our Cookie Policy and Privacy Policy.
Licensed under cc by-sa 3.0 with attribution required.