When the appliance receives an email for John.Smith@abc.com, for example, the message transfer agent (MTA) looks up the entry for abc.com to know where to forward that email. If you have mapped the domain abc.com to the host mail.abc.com, then when analysis is complete, the MTA forwards the email to the mail server at host mail.abc.com. If the email recipient mailbox is not locally hosted, the MTA forwards the message to the MTA host at the next-hop IP address configured for the domain. You can also use the WebUI or CLI to configure the appliance to allow email on all subdomains for abc.com.
Note
Domain and next-hop must be configured for MTA deployments. For all other deployment modes, configure domain and next-hop only if you plan to use the admin Cc: notification feature or the Bcc: copy feature.
To enable the appliance MTA to load balance email traffic to multiple MTA hosts, you can specify up to 25 next-hop IP addresses. Each address can be assigned a weight. The weight can range from 1–256 and the default is 100. The MTA load-balances outgoing SMTP traffic proportional to the weight associated with the next-hop addresses. For a domain that forwards to a single MTA host, the weight value is 256.
When adding a new domain and next-hop definition to the MTA, you have the option of specifying that the next-hop IP address be determined using DNS MX record lookup. This option specifies whether the MTA will use a DNS MX record translation on the next-hop specified for a domain. MX lookup provides more flexibility to an administrator who wants to use DNS for either redundancy or load balancing. If enabled, the MTA will request an MX record translation from DNS. If it is not enabled, a record translation is done.
When the appliance is deployed in MTA mode, no maximum email message size limitation is imposed on incoming email traffic. The appliance accepts all email messages of any size in MTA mode. To limit email message size, Trellix recommends that you modify the gateway configuration.
Although the ADD Product Series appliance accepts any-sized email traffic from the network stream, appliance analysis engines—the Multivector Virtual Execution (MVX) Engines—typically analyze emails that are 35 MB or less because most enterprises tend to block emails of larger message size. However, this policy is configurable.
You also have the option of specifying the next-hop fail over MTA domain for email analysis and forwarding if the primary MTA domain server is brought down. This option is configurable using the Web UI or CLI.