SmarterMail in High-volume Deployments

Who Should Use This Document

This document is intended for use by large and enterprise businesses as they develop an effective architecture for their SmarterMail system implementation. For best results, this document should be used in conjunction the SmarterTools Knowledge Base.

Determining the Required Architecture

It is not unusual for a business to generate upwards of 50 legitimate mail messages, per employee, per day on average. Considering the relative volume of spam and other abusive messages that are currently prevalent, the total number of messages processed per user/mailbox could easily exceed 250 per day . Companies in technology, finance, and other communication-intensive industries might have much higher average email volumes. A tendency toward the prolific use of attachments and email graphics can also influence performance in mail environments. SmarterTools encourages readers to determine which architecture is right for them based upon anticipated email volume as opposed to head-count because email load is a far better predictor of server requirements than the number of mailboxes on a system. In higher volume environment's it's also important to realize how end users synchronize mail to various mail clients and mobile devices ( using POP, IMAP, EAS, EWS, MAPI, or a variety of all of these) and how this can impact resource availability such as drive i/o.

SmarterMail is built around a fully scalable model, so moving from one architecture recommendation to another requires relatively simple enhancements or modifications that can yield significant increases in performance and volume capacity.

That said, the authors have chosen to divide their recommendations into three categories: individual and micro-business architectures, small to medium-sized business architectures, and high-volume deployment architectures. For the purposes of these recommendations:

Individuals and micro-businesses shall be defined as mail environments with average email volumes of up to 25,000 messages per day (12,500 in/12,500 out). This infers a maximum of 100 mailboxes. Information regarding these architectures can be found in our Individual and Micro-business Deployments guide.
Small to medium-sized businesses shall be defined as mail environments with average email volumes of up to 400,000 messages per day (200,000 in/200,000 out). This infers a maximum of 1,600 mailboxes. Information regarding these architectures can be found in our Small to Medium-sized Business Deployments guide.
High-volume deployments shall include ISPs, hosting companies, large businesses, and enterprise organizations with average email volumes numbering in the millions. This infers organizations with many thousands of mailboxes. Information regarding these architectures is available in this SmarterTools document.

General Architecture

The general recommendation for the high-volume system architecture is detailed in Figure 1 below.

General high-volume SmarterMail architecture diagram

SmarterMail Primary Servers

This server is the central data processor and repository of your client's email. Users connect to this server using POP, IMAP, EAS, EWS or MAPI to receive email, and use SMTP to send email out. Webmail is also hosted on this server to help those without email client software. In addition, the SmarterMail server performs spam-blocking (with the exception of SpamAssassin) and virus protection operations. Users can also synchronize their contacts, and calendar across several different methods. A SmarterMail network may contain one or more mail servers. Under normal activity—and assuming sufficient disk space³—each server should be able to handle up to 40,000 users per server (1 million messages per day).

For high-volume deployments utilizing this architecture, SmarterTools recommends the following server specifications for SmarterMail servers:

Dual-core, server-grade processors
8 - 16 GB of RAM, depending on the sync technologies used
RAID 1 array for the operating system and program files
One single SSD drive or RAID 0 array for the email spool
RAID 10⁴ array to store user data and email (8 disk minimum when using platter drives, even SAS 10 and 15k drives.) If a Hybrid setup can take place with SSD Cache on a RAID10, even better. The administrator will want to configure their storage to optimize random 4k reads\writes. SmarterMail is very heavy on random Reads\Writes on small sectors. Estimated IOPS usage for a high volume deployment = 10-20 MBps with heavy random 4k reads\writes, which breaks down to 5,000 - 10,000 IOPS.
Windows Server 2019, 64-bit is required
Virtual machines are not recommended for large deployments as restrictions on disk i/o can seriously impact performance. (Though this is not a factor when leveraging properly designed storage networks with adequate i/o availability)

Email Virtualization: VPS Environments

A virtual server environment is when one physical hardware device is partitioned so as to operate as two or more separate servers. SmarterMail can be deployed in all types of virtual server environments and has been tested with most major virtualization software (such as Hyper-V, VMware, Virtual Box, Virtuozzo and Zen). The most important factor of performance in a shared environment is the design and implementation of the storage network to ensure SmarterMail has enough IOP availability to the storage pool. Leveraging iSCSI with IO Multipathing is recommended over standard 1Gbe connections if fiber channel, or 10Gbe is unavailable.

SmarterMail in the Cloud

SmarterMail has been tested in Amazon EC2, Google Cloud, as well as Azure and functions as expected. One thing to take into consideration here is ordering the proper instance with adequate storage IOPS.

Please take into consideration, most cloud providers also restrict SMTP traffic.

With Amazon, you'll need to fill out a request form to remove e-mail sending limitations. This can be found here: https://aws.amazon.com/forms/ec2-email-limit-rdns-request

With Google Cloud, you'll need to leverage an Outbound gateway such as SendGrid. More information can be found here: https://cloud.google.com/compute/docs/tutorials/sending-mail/

Windows Azure does not place such restrictions when it comes to sending out over port 25 but do place restrictions on overall outgoing traffic and implement bandwidth throttling based on the size of your VM.

Extending Capacity Via Outbound Gateways

Outbound gateways are used for handling the delivery of remote mail to reduce the load on the primary mail server(s). An outbound gateway does not perform the tasks of storage and/or retrieval of end users' mail, freeing it to process many times more outgoing messages than a primary server could be expected to handle effectively.

Most small to medium-sized business environments will not need an outbound gateway. However, as a business grows, the addition of an outbound gateway can add significant capacity to a mail network and smooth the transition to higher volumes and larger networks. In the opinion of the authors, a single primary server in this configuration with distributed spam handling and a SmarterMail outbound gateway can effectively process upwards of 400,000 messages per day (200,000 in/200,000 out). This infers a maximum of 1,600 employees/mailboxes.

Businesses that choose to extend capacity via an outbound gateway can download SmarterMail Free and set it up as a free gateway server. More information about configuring SmarterMail as a free gateway server is available in the SmarterTools Knowledge Base.

SmarterMail Outbound Gateway Servers

SmarterTools recommends the following hardware for SmarterMail outbound gateways:

Dual-core processor
1 GB of RAM
SSD drive for dedicated spool, though SATA can be used for lower volume

This hardware configuration can support many SmarterMail servers, but SmarterTools recommends an ideal ratio of one gateway server for every five primary mail servers, reducing the risks of blacklisting and the effects of potential hardware failures.

Configuring SmarterMail for Failover

SmarterMail Enterprise allows organizations to decrease the likelihood of service interruptions and virtually eliminate downtime by installing SmarterMail on a hot standby that is available should the primary mail server suffer a service interruption. For businesses that use their mail server as a mission-critical part of their operations, failover functionality ensures that the business continues to communicate and that productivity remains at the highest levels possible, even if there is a primary server failure.

For more information on configuring failover, see the Configuring SmarterMail for Failover section of the online help.

Securing an Email Server

Backups, Policies, and Infrastructure

As the old saying goes: "Stuff Happens". And, it happens for any one of a number of reasons. As a result, email administrators need to ensure they have safeguards in place in order to be able to react (by being proactive) when these issues occur.

One of the most important things is to ensure you're backing up SmarterMail, from configuration information to domains and users. There are several ways you can do this, and several systems and services you can use. Below are a few knowledgebase articles that can help you plan how to backup SmarterMail.

Of course, then there are backup and retention policies. With the many regulations and certifications out there, these will vary based on your business. However, having incremental, and complete, backups on a regular schedule can help ensure that, should a disk go bad, or if you run out of disk space, you will have relevant backups that can be used to restore SmarterMail, and the various domains and users, back up and running as quickly as possible.

Next, things like firewall protection needs to be considered, and locking down access to your mail server, especially if email is all the server is being used for. There are a few number of ports that need to be opened, and the rest could probably be disabled or otherwise locked down. The point is, there are a few things to consider when securing your SmarterMail server and keeping it protected. A good system admininstrator needs to look at all areas of access, and pontential points of exploaitation, and really lock them down. That starts with the design of your SmarterMail server (e.g., RAID options, disk types and sized, etc.) and then branches out from there.

Recommended Spam Protection Measures

SmarterMail uses a flexible, multi-layered spam prevention strategy to achieve 97% spam protection out-of-the-box. Initial spam settings are configured during installation, but system administrators can modify these settings to meet their unique needs at any time.

Since spam prevention strategy is an integral component of mail server deployment, a few of the most important spam-fighting measures available for SmarterMail are discussed below.

Message Sniffer

Available as an optional add-on for SmarterMail, Message Sniffer complements SmarterMail's built-in antispam and antivirus features and accurately captures more than 99% of spam, viruses, and malware right out of the box. It learns about your environment automatically to optimize its performance and accuracy without your intervention; and it can be easily customized to meet your requirements. Because Message Sniffer runs all of its signatures locally, it doesn't need to communicate with any services outside of the mail server, making it quicker and more efficient. Furthermore, the database is regularly and automatically updated to protect against new spam and malware attacks.

For more information about the Message Sniffer add-on, please visit the SmarterTools website.

Cyren Premium Antispam

Available as an optional add-on for SmarterMail, Cyren Premium Antispam uses Recurrent Pattern Detection (RPD) technology to protect against spam outbreaks in real time. Rather than evaluating the content of messages, the Cyren Detection Center analyzes large volumes of Internet traffic in real time, recognizing and protecting against new spam outbreaks the moment they emerge. When combined with SmarterMail's out-of-the box antispam measures, the Cyren Premium Antispam add-on can effectively block 99% of spam from users' inboxes.

For more information about the Cyren Premium Antispam add-on, please visit the SmarterTools website.

Greylisting

SmarterMail includes greylisting, an effective method of blocking spam at the SMTP level. Using the greylisting feature in conjunction with SpamAssassin will prevent a large percentage of spam messages from being received by the SmarterMail server and drastically reduce the SpamAssassin work load. At the time of this writing, the greylisting feature is effectively blocking up to 85% of spam at the SMTP level and greatly enhancing the effectiveness of SpamAssassin. The authors expect that the effectiveness of greylisting will diminish over time as spammers learn to adjust to this technique. Additional information about greylisting can be found in the SmarterMail Online Help or at http://greylisting.org.

Other Built-in Antispam Measures

SmarterMail's multi-layered spam prevention strategy also includes SPF, DKIM, DMARC, reverse DNS, RBL, blacklist/whitelist, SMTP blocking, custom headers, and per-user spam weighting. More information about these important features is available in the SmarterMail Online Help and/or the SmarterTools Knowledge Base.

Recommended Virus Protection Measures

SmarterMail includes several antivirus enhancements that prevent the mail server from being compromised, including support for incoming and outgoing SSL/TLS connections, administrator access restriction by IP, intrusion detection (IDS), active directory authentication, harvest attack detection, denial of service (DOS) attack prevention, malicious script authentication, and brute force detection for webmail.

Cyren Zero-hour Outbreak Detection

Available as an optional add-on for SmarterMail, Cyren Zero-hour Antivirus can further extend SmarterMail's built-in virus protection measures. Rather than depending on heuristics, Cyren Zero-hour Outbreak Detection uses Recurrent Pattern Detection (RPD) technology to scan the Internet and identify virus and malware outbreaks as soon as they emerge.

For more information about the Cyren Zero-hour Outbreak Detection add-on, please visit the SmarterTools website.

Optional Servers

An alternative recommendation for the high-volume system architecture incorporates optional servers in place of the cloud-based antispam and antivirus options. Instead, actual servers can be used for SpamAssassing and/or ClamAV. System administrators can even incorporate their own server solutions, hardware appliances or more.

Distributed SpamAssassin Servers

SmarterMail includes support for SpamAssassin, an open source spam filtering program. When implemented, SmarterMail will pass an incoming message to SpamAssassin. SpamAssassin returns the message with a spam score which can be used to filter mail alone or in conjunction the other spam filtering options in SmarterMail.

The Windows version is limited to processing a single message at a time, effectively handling approximately 100-200k spam messages per day and is usually more than adequate to the needs of low and medium-volume environments. However, the Linux version of SpamAssassin can process multiple spam messages simultaneously, allowing it to process significantly more messages that its Windows counterpart. Therefore, SmarterTools recommends the stand-alone Linux version of SpamAssassin for high-volume environments (see Figure 2).

Additional information about SpamAssassin, including downloading instructions, is available at https://spamassassin.apache.org/.

SmarterTools recommends the following hardware for stand-alone SpamAssassin servers:

Dual-core processor
2 GB of RAM
Dedicated SATA drive

ClamAV Servers

SmarterMail includes support for ClamAV, an open-source project offering superior antivirus protection that resides on the primary mail server, or in high-volume environments, on a remote server in a Linux environment. More information about ClamAV is available at www.clamav.net.

SmarterTools recommends the following hardware for stand-alone ClamAV servers:

Dual-core processor
1 GB of RAM
Dedicated SATA drive

DNS Cache Servers

DNS cache servers can be added to speed email delivery through systems with exceptionally heavy traffic or to take the load off of existing network DNS servers in Web hosting (or other) environments in which Web traffic is very high. Adding an email-dedicated DNS cache server also allows the control of caching rates for DNS queries for mail servers independently of the main network. The requirements—or lack thereof—for email-dedicated DNS servers vary greatly from organization to organization. Therefore, SmarterTools does not currently provide a hardware or configuration recommendation for DNS servers.

If it is determined that a system requires email-dedicated DNS caching, SmarterTools recommends a BIND solution. Information regarding BIND solutions is available at https://www.isc.org/bind/.

Using SmarterMail with Third-party Solutions

Inbound Gateways

In certain ultra-high-volume environments, inbound gateways are used to offload spam and virus checking from the primary server(s). In such environments, SmarterTools does not recommend that SmarterMail servers be used as inbound gateways. Instead, the load should be passed to third-party products.

Most spam checks and filters built into SmarterMail utilize the IP address of the mail sender. When using a third party inbound gateway, all mail passes through that gateway prior to arriving at the SmarterMail server(s), which will negatively impact the functioning of the IP-based spam filters. For this reason, you will want all spam filtering to be done via the inbound gateway when using a third party inbound gateway solution.

For full list of third-party antispam/antivirus products that have been tested with SmarterMail, refer to the SmarterMail Antispam, Antivirus and Security page on the SmarterTools website.

Summary

SmarterMail is a good choice for high-volume mail environments. The proper configuration and system architecture outlined in this document will provide a solid, reliable foundation. Because variations exist due to different volumes and client needs, SmarterTools suggests starting with these recommendations and then adjusting server proportions, limits and specifications based on the usage patterns that result.

¹Intel presentation, “IT Business Value”, 9-16-2005.

²“Nearly 80% of email messages sent world-wide are spam….”; Deleting Spam Costs Business Billions, Information Management Journal, May/June 2005, Nikki Swartz.

³The amount of disk space allocated per user and per domain is set by the system administrator.

⁴While a RAID 10 configuration is recommended for SmarterMail Primary Servers, the authors recognize that some companies have policies that require the use of alternate RAID configurations. In this case, other RAID configurations may be used with the exception of RAID 1. The use of RAID 1 arrays in this configuration will likely result in a significant reduction in disk performance (up to a 50% loss vs. a single drive and up to 8 times slower than a 4-drive RAID 10 implementation.