Adding a Domain and Routing Email
After you complete the setup wizard, the next step is to tell DeepFilter which domains it will protect and which email server the cleaned email should be delivered to. This page covers adding a domain from the panel, defining a relay for outbound email, and the MX routing on the DNS side.
How adding a domain works
DeepFilter is a gateway: it receives email from the internet, scans it and delivers it to your existing email server. Two pieces of information are therefore required for each protected domain:
| Information | What it means |
|---|---|
| Domain | The email domain to protect (example: alanadi.com) |
| Destination mail server | The IP address or name of the server that clean email will be delivered to |
Once the domain has been added in the panel and approved, the email routing configuration is written automatically. You do not need to edit any files on the server by hand.
DeepFilter does not store email and does not host mailboxes. User accounts, mailboxes and archives remain on your existing email server.
Adding a domain from the panel
Sign in to the management panel at https://<SUNUCU_IP>:9443 with your administrator account.
- Open the domains section and add a new domain.
- Enter the domain to protect (example:
alanadi.com). - Enter the destination mail server that clean email will be delivered to.
- Save, then approve the domain.
After approval, the routing configuration is applied automatically and DeepFilter starts accepting email addressed to that domain.
If you enter the destination mail server incorrectly, DeepFilter scans the email but cannot deliver it; messages pile up in the queue. Always send a first test email after adding the domain and confirm that it reaches the destination server.
Making the destination mail server accept DeepFilter
Your existing email server will now receive email from DeepFilter rather than from the internet. The destination server must therefore accept SMTP connections from the DeepFilter server's IP address. If your destination server has IP restrictions, firewall rules or a connection filter, add DeepFilter's IP address to those lists.
Adding relay IPs for outbound email
DeepFilter can process not only inbound email but, if you want, also the email leaving your own servers. To enable this, you define in the panel the IP addresses of the servers that are allowed to send email through DeepFilter.
- Open the outbound email / relay settings section in the panel.
- Add the IP address of the server that will send email.
- Save.
Email cannot be sent through DeepFilter from an IP address that is not on the list. This prevents your server from being abused as an open relay.
Do not add broad IP blocks or ranges covering the whole internet to the relay list. Define only the IP addresses of your own servers that genuinely send email.
Pointing the MX record at DeepFilter
Once the domain is defined in the panel and a test email reaches your destination server, the final step is to point the MX record at the DeepFilter server on the DNS side. Until the MX record changes, internet email keeps taking its old route.
Required DNS records:
| Record | Value | Description |
|---|---|---|
| A | mail.alanadi.com → server IP address | The name of the DeepFilter server |
| MX | alanadi.com → mail.alanadi.com, priority 10 | Routes inbound email to DeepFilter |
| PTR | Server IP → mail.alanadi.com | Reverse DNS; requested from your IP provider |
| SPF (TXT) | v=spf1 ip4:SUNUCU_IP ~all | Sender verification for outbound email |
Once the MX record has propagated worldwide, email addressed to your domain arrives at DeepFilter, is scanned and is delivered to your destination mail server.
If the PTR record or the SPF record is missing, many receiving servers may reject the email you send or mark it as spam. You must request the PTR record from the service provider you obtained your IP address from; you cannot add it from your own DNS panel.
Verifying the routing
You can verify from your own computer that your MX record points at DeepFilter:
dig +short MX alanadi.com
dig +short A mail.alanadi.com
The MX query should return mail.alanadi.com, and the A query should return your DeepFilter
server's IP address.
To see that DeepFilter accepts connections on port 25:
nc -zv mail.alanadi.com 25
If the connection cannot be established, the DNS record may not have propagated yet or port 25 may be closed from the outside. For the port list and firewall requirements, see the Network Requirements page.
You can run the same checks from the panel: the Domain tab of the Monitor → Health Tools screen queries the MX, SPF, DKIM and DMARC records from external resolvers and flags a backup MX record that bypasses the filter; the Server tab checks inbound and outbound port 25 access, the PTR record and the certificate. For details, see the Health Tools page.
To track who sends email on behalf of your domain through recipients' DMARC reports, you can enable the domain's report address on the Monitor → DMARC Management screen (see DMARC Management).
Multiple domains
You can add more than one domain to the same DeepFilter server. You define a separate destination mail server for each domain; different domains can be delivered to different servers. MX and A records must be configured separately for each new domain.
Before taking a new domain live, the safest route is to leave the MX record untouched and send a test email directly to the DeepFilter server, so you can see that the delivery chain works.