Silicon Graphics Gauntlet, Administrator'S Manual, Page: 172 / 306

146
Chapter 17: The Graphical Management Interface
Sendmail on Gauntlet Servers
Your mail system should be configured for compatibility with your DNS configuration.
That is, the sendmail.cf file on the host that your DNS server advertises as your Mail
eXchanger (MX) must be configured to accept mail for your network. This file must also
specify what to do with mail after it is received. Usually, mail is forwarded to a master
mail host on the internal network. This host knows the addresses of internal users and
how to deliver mail to them.
Note:
By convention, the domain name of your network is your electronic mail address.
For example, user “Harry” at XYZ corporation, whose domain name is XYZ.com has the
electronic mail address “harry@XYZ.com.” To reinforce the electronic mail address of
your sight and to make it easy for others to reply to your users’ mail, configure your
sendmail.cf to rewrite all addresses to conform to this convention.
Mail Hubs
When you have installed a firewall at your site, mail to any of the users on internal hosts
must be focused—brought together—to pass through the firewall, and then delivered to
the appropriate destinations. Whether or not in a firewall context, that is essentially what
a mail hub is: mail bound for different destinations is focused together and delivered to
the mail hub, and the mail hub figures out where the mail should go next.
You have three choices for where you can locate your domain-level main mail hub:
• outside the firewall (i.e., in your DMZ)
• on your firewall
• or inside your firewall.
Running a mail hub outside your firewall doesn’t make very much sense, since it is more
exposed (vulnerable to attack), and ultimately it needs to deliver mail through the
firewall anyway, so it does not substantially improve security on the firewall.
Furthermore, there do exist mailers on the Internet which do not follow the proper RFC’s,
and try to deliver email destined for username@domain_name to the machine
domain_name, even if there is an MX record for domain_name pointing at your external
mail hub machine. Unless you’re willing to let such email bounce, you’re going to have
to be able to deal with email directly sent to your Gauntlet firewall anyway.