Third-party mail gateway
Normally mail moves directly in and out of your mail server: external senders deliver to us, and we deliver your outgoing mail to each recipient.
A third-party mail gateway puts an external service into that path: an anti-spam appliance, a compliance or archiving filter, or a smarthost your organization must send through.
If you have no such service, leave both gateways off. The direct path is right for almost everyone.
Set up a gateway on the Mail service page: open Services, select the zone, then the domain's Mail service. The two directions are independent; turn on one, both, or neither. A small Mail Flow diagram shows the resulting path and updates live as you change the switch.
For a complete setup with a named provider, where the gateway settings are one step among several, see Third-party integrations.
The incoming gateway
Use this when an external MX must sit in front of our mail server. Incoming mail arrives at the gateway first, which filters it and passes the clean mail to us.
| Field | What it is |
|---|---|
| Gateway MX Records | One per line, as <priority> <hostname>; a lower number comes first. These become the domain's public MX records, so external senders deliver to the gateway, not to us. |
| Gateway Source Addresses | The IP addresses or hostnames the gateway forwards the filtered mail from. We refuse incoming mail from any other source. |
Refusing other sources is the point of the gateway: it stops a spammer from bypassing the gateway and reaching us directly. With the field empty, we accept mail from anywhere and the gateway loses most of its value.
The panel warns you when the gateway is on and no source addresses are set. Fill in the gateway's exit IP addresses unless you have a specific reason not to.
The outgoing gateway
Use this when the domain's outgoing mail must go through an external smarthost or compliance gateway instead of directly to each recipient.
| Field | What it is |
|---|---|
| Gateway Destination Addresses | The IP addresses or hostnames we deliver outgoing mail to. With more than one, we try them in order; later ones are fallbacks. |
| SMTP Authentication (SASL Username / Password) | Optional. Set both if the gateway asks us to authenticate; leave them empty if it trusts us by IP address. |
Your mail now leaves from the gateway's servers, so the gateway's authentication records must be in place for receivers to keep trusting it:
| Field | What it does |
|---|---|
| Gateway SPF Record | The full SPF value from the provider. It replaces the generated SPF record in the published TXT record, authorizing the gateway's servers to send for your domain. |
| Gateway DKIM Selector and Gateway DKIM Record | The provider's DKIM key. The panel publishes it beside our own key, at <selector>._domainkey.<domain>, so the gateway can sign your outgoing mail and DKIM keeps passing. |
The panel handles DNS for you
Turning on a gateway changes the published records:
- the incoming gateway puts its MX records in place
- the outgoing gateway puts its SPF record in place and adds its DKIM record
As always, you don't edit DNS by hand. The Generated DNS Records section of the Mail service page shows the new values after you save. See DNS is managed for you.
The usual cause is a missing or wrong gateway SPF or DKIM value. Check both against what the provider gave you. Sender verification explains what each record proves.