You can do the following to load balance email traffic:
Use your DNS server to load balance emails across multiple Email Security — Server appliances.
Modify your next-hop DNS "A" record to support multiple IP addresses.
A typical named service uses zone files located in the /var/named/zone directory. This section includes example zone file content.
For information about configuring DNS server settings on the Email Security — Server appliance, see Basic network configuration .
Note
Trellix recommends the deployment of a load balancer for optimal traffic monitoring, performance, and management.
Load balancing email traffic across multiple EX appliances
Email delivery requires that the DNS server perform an MX record lookup to determine the domain of the email recipient. The DNS server then provides the name of one or more mail servers to use for the destination domain. By responding with a list of multiple mail servers, the DNS server provides a means for load balancing across mail servers.
You can use this technique to spread the malware detection workload across multiple Email Security — Server appliances. When multiple Email Security — Server appliances are deployed in MTA mode, the DNS server can be configured to provide a list of multiple appliances in response to an MX record query.
Important
This load balancing feature is available only on Email Security — Server appliances that are deployed in MTA mode. In the BCC and SPAN/TAP deployment modes, the appliance does not forward email traffic, so the DNS MX record for them should point to some other device.
The following is an example DNS zone file for the example.com domain that includes multiple Email Security — Server appliances for load balancing:
$TTL 3H @ IN SOA example.com. root.example.com. ( 0 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum NS example.com. MX 10 hayes.example.com. MX 10 king.example.com. MX 10 lyon.example.com. TXT "NEXT-MAILHOP" localhost A 127.0.0.1 example.com. A 172.16.141.102 mail CNAME hayes.example.com. next-mailhop A 172.16.141.102 lyon A 172.16.141.13 hayes A 172.16.141.15 king A 172.16.141.21
In this configuration, the email traffic load for the example.com domain is balanced across three Email Security — Server appliances with hostnames of hayes, king, and lyon. The DNS server will respond to an MX record query for example.com with "hayes," "king," and "lyon."
The mail host next-mailhop is the final destination of all emails. Each of the Email Security — Server appliances must use "next-mailhop" as the next-hop address to forward emails. This can be configured on the Settings: Email MTA page of the Email Security — Server Web UI or with the following CLI command:
hostname (config) # email-analysis domain example.com next-hop next-mailhop.example.com
Important
Each load balancing Email Security — Server appliance should use the same host as its next hop.
Load balancing email traffic across multiple next hops
You can modify your next-hop DNS A record to support multiple IP addresses. This provides load balancing across multiple next-hops for a single Email Security — Server appliance. With this configuration, all emails, block notices, "admin" notices, and "bcc" notices are forwarded in round robin fashion from the configured domain to multiple next-hops.
Note
See Configuring notices for information about block, "admin," and "bcc" notices.
The following is an example DNS zone file fragment for the example2.com domain that includes multiple IP addresses for next-hop load balancing:
NS example2.com. MX 10 howard.example2.com. howard A 1.1.220.20 next-mailhop2 A 1.1.141.102 A 1.1.141.21 A 1.1.141.13
In this example, the Email Security — Server appliance with the hostname howard serves as the MTA for the example2.com domain. The next-hop is defined as a round-robin A record named next-mailhop2, and three IP addresses are configured for it. The domain and next-hop can be configured from the Email MTA Configuration page of the Web UI or with the following CLI command:
hostname (config) # email-analysis domain example2.com next-hop next-mailhop.example2.com