I have 2 sm servers, which manages our customers mail accounts

 

1) In dns I have server 1 as the primary mx and server 2 as secondary mx for the domains on server 1 and vise versa,  ie the Server 2 is a forwarder/mxbackup for Server 1 domains and vise versa Server 1 is domain forwarder/mxbackup for domains on server 2

 

2) On server 1 under incoming gateways, I have a domain forwarder setup pointing to the server 2, configured with server 2's ip address, user verification is web service, domains is web service, and smartermail gateway mode is enabled and the correct info is inserted. 

3) Also configured is a mxbackup on the server 2 ip addresses, no user verification, but smartermail gateway mode enabled.

 

4) On server 2 I have the opposite configured pointing to server one, so effectively each server is a mxbackup/secondary mx/domain forwarder for the other server.

 

What I experience is sometimes it seems that if you reboot the server 1, mails coming in on server 2 destined for server one fail and bounce. Now I cannot remember exactly what the issue was, but a while back we only had each server configured as a mxbackup for the other, but what we were seeing was when the one server was down the secondary server used to return "user does not exist" to the sending server, ie it could not verify the user accounts on the primary server. 

 

So after a long story, please advise me what route we should follow, I want to achieve the following:

1) Each server must be a mx backup for the other server, if one of the servers goes down or is rebooted.

2) Each server must be a secondary mx for the other when the servers are running

3) if either of the servers reboot or fail, then there mut be no "user does not exist" etc.