The firewall rules are updated when the Email Connector configuration is updated. When the Email Connector status changes, the ATD/IS cluster status changes, and ATD boots. The permissive firewall rules retain one specific IP address for your dynamic DNS host name, until the next instance of rules update runs.

NOTES:

• At delivery time, the Email Connector tries to resolve the FQDN of the relay host by performing an A record lookup.
• Email Connector can use the DNS cache for the FQDN.

The dynamic DNS host name resolves to different IP addresses from time to time. If it resolves to the same IP address that the firewall rules were created with, the Email Connector tries to establish an SMTP connection toward the same host IP address as the permissive iptables rules. The firewall rules allow such an outgoing SMTP connection so that the scanned email is delivered to the relay host successfully. If it resolves to a different IP address from which the firewall rules are created, the Email Connector tries to establish an SMTP connection toward another host IP address. This host has no matching permissive iptables rules and the firewall blocks the outgoing SMTP connection. The Email Connector notices it as a refusal of connection and reports it back to your permitted sender with an SMTP error code.