There is a difference between Backup MX and Domain Forward in your Incoming Gateway settings in Smartermail. Backup MX will accept all email, regardless of who it is addressed to, and attempt to deliver when the designated IP is available again, whereas Domain Forward (when Smartermail Gateway Mode is enabled) will validate each user before accepting the email. 

 

As such, a Backup MX will generate a considerable amount of non-deliverable responses as it is blindly accepting email that it will try to deliver to the designated IP that may not be ultimately accepted by your primary Smartermail server (due to SMTP Blocking, Incoming Spam Weight Threshold, etc., along with the usual 500 errors such as "550 - No Such User Here").

Important Note: Be sure to add your Backup MX IP to your SECURITY > ANTISPAM ADMINISTRATION > BYPASS GATEWAYS. That may resolve your problem, especially if the Backup MX triggered your primary Smartermail's IDS.

Steve, Scarab, thanks for the replies. Still having issues with getting this to work right, just like this guy did. We have the incoming gateway config'd on the backup server to use the web service for user verification from the main server. DNS resolution is working fine from the backup server and I can telnet to port 25 on the main server from the backup server. We have no domains config'd on the backup server running 12.3. The guy in the link had a problem with the MX records not matching the IP he setup in his incoming gateway, but that is not that case in our setup. Still scratch my head....

Still having issues today with getting it to work. The backup mx appears to think it is that primary server for any domain we test, even when there are no domains setup on it. I can browse to the user management wsdl from the backup mx server without issue so it seems to me that even though the backup mx has no domains and has an internal gateway setup, it still isn't functioning quite right. Unless I'm missing something easy. 

 

Also, I'm not sure about whitelisting. 1, it isn't a problem yet because our primary server isn't even receiving any mail from our backup mx. 2, any joe blow can find the IP's of your MX servers, spoof your IP, and then get past all of our spam mechanisms...