|
I am deploying multiple websites & mail domains for my group companies. I would host DNS on one server and websites on another. Should I host mail server on same machine as web server in the DMZ?
For mail server - should i use Windows POP3 and SMTP service on it and then download from this server to another maill server located behind DMZ with an application (third party mail servers like sendmail / mailenable) where i can also do archieving to reduce spam hits or should i just host single mail server on the DMZ. I do not intend to let 50% of users to download the mail, they would be using web explorers to access / reply while other 50% might download.
Can Mail & Web Server Deployed on Same machine without compromising security?
A single mail server in the DMZ will involve the least amount of work and will serve internal and external users without punching holes in the firewall. It's okay to run WWW on the same server if you have a modest amount of mail, users, or web traffic. Naturally, the busier it gets the more computer you will need.
If you want to have your POP/IMAP server inside and your SMTP server outside, set up your inside server to listen only to port 25 traffic coming from your outside server. Let the outside server do the filtering and forward all the clean mail inside. (Don't poll for mail unless you're REALLY paranoid, it slows delivery down).
To add a webmail server to this, set up the same kind of trust arrangement. Most of them use IMAP to query the mail server, so open just port 143 between the web server and the inside server.
|