Syed Jahanzaib Personal Blog to Share Knowledge !

February 1, 2019

Forced routing of selective emails to ISP SMTP via Mikrotik Routing

Filed under: IBM Related, Mikrotik Related — Tags: , , — Syed Jahanzaib / Pinochio~:) @ 10:06 AM



We have a LAN environment with our own email server [IBM Lotus Domino] hosted locally. Mikrotik router is acting as our gateway router with /29 public pool & port forwarding from mikrotik public ip to email server is configured. Barracuda Antispam gateway is in place as well.

Problem & Challenges :

Sometimes there are few email servers on the internet that does not accept our emails, either they bounce back or silently drop our emails despite our public IP is not listed in any of blacklisting on the internet[It happens commonly with microsoft hosted email servers as they silently drop our emails without informing any reason]. If we use our ISP SMTP as relay in the DOMINO configuration, then the emails delivers to those particular servers without problem. But we cannot use ISP SMTP for all emails routing/relaying as they have per day sending limit, and we donot get proper reports for delivered or hold emails.

Another BIG problem is that sometimes ISP’s SMTP server IP gets ban/added in the spamhaus or likewise SPAM blacklist database & when this happens 80-90% emails bounces back.

So we needed a solution where we should not use ISP SMTP relay all the time but only particular destination email server’s mails should be routed to ISP smtp. & it should all be controlled by our Mikrotik RouterOS dynamically/centrally.


First created a address list which should contain IP addresses of remote email servers [that donot accept our emails directly]

/ip firewall address-list
add comment="remote company mail server X IP" list=few_mails_routing_2_primary_ISP_smtp

Now using NAT rule, we will forcefully route all emails [port 25 traffic] going to above address list, will be routed to ISP SMTP , with below rule …

# is the ISP SMTP IP

/ip firewall nat
add action=dst-nat chain=dstnat comment="Few Mails Routing 2 primary ISP smtp" dst-address-list=few_mails_routing_2_primary_ISP_smtp dst-port=25 protocol=tcp to-addresses= to-ports=25

It’s done.

BUT next challenge is to overcome issue when ISP changes it’s SMTP IP address for whatsoever reason, so we need to schedule a script that will keep checking the ISP SMTP IP by resolving it via google dns, and update the ISP SMTP IP in the NAT rule. [As per my knowledge we cannot put DNS name in TO-ADDRESS field, this is why putting IP is necessary, & update it dynamically is also essential to avoid bouncing email dueot blacklisting for ISP old SMTP IP]

the Script !

or workaround I suggest for very particular problem?

# Mikrotik routerOS script to resolve ISP SMTP, and add it to variables & in NAT rules
# Useful in scneario where ISP change its smtp IP frequently (to avoid SMTP Blacklisting)
# Script by Syed Jahanzaib / aacable at hotmail dot com / https : // aacable . wordpress . com
# 31-January-2019
# Find rule with following comments
:local COMMENT "few_mails_routing_2_primary_ISP_smtp";
# DNS Name of SMTP for resolving
# Which DNS server to be used for resolving
:local DNSSERVER "";
# Below is Default IP of SMTP Server, so that if resolving cannot be done for what so ever reason, set this IP as DEFAULT SMTP
:local DEFAULTSMTP "";
# Destination port that need to be redirected
:local DSTPORT "25";
# Dat time variables
:local i 0;
:local F 0;
:local date;
:local time;
:local sub1 ([/system identity get name])
:local sub2 ([/system clock get time])
:local sub3 ([/system clock get date])
:set date [/system clock get date];
:set time [/system clock get time];
# Set script last execution date time
:global SMTPLastCheckTime;
:set SMTPLastCheckTime ($time . " " . $date);

# Set global variables to store for ISP SMTP & its last resolved status

# Check if resolving is doable, then act accordingly
:foreach addr in $RESOLVELIST do={
:do {:resolve server=$DNSSERVER $addr} on-error={
:log error "$ISP1SMTPDNSNAME resolved result: FAILED @ $date $time !";
/ip firewall nat set to-addresses=$DEFAULTSMTP to-ports=$DSTPORT [find comment="$COMMENT"] }}

# If resolving is ok from above results then set resolved address as default SMTP ip
:log warning "$ISP1SMTPDNSNAME resolved result: SUCCESS @ $date $time !";
/ip firewall nat set to-addresses=$ISP1ACTIVEIP4SMTP to-ports=$DSTPORT [find comment="$COMMENT"]

We can add dynamic names in the ISP SMTP address list.






  1. I am trying to figure out a script for dual WAN, where it pings hosts(google) to monitor WAN1 and if it goes down it fails over to WAN2 and if WAN1 comes back up then it failsback to WAN1. Would you be able to assist? Let me know and I can email you?


    Comment by tyronbird — February 3, 2019 @ 7:59 PM

  2. hi, i found your tutorial very educational. i work for an ISP. i have 2xMT CCR1036 6.43. R1 is connected to ISP1 (500Mbps)via ebgp. And R2 to ISP2(450Mbps) also via ebgp. Both ISPs have different ASN. My 2 MTs are connected via OSPF and ibgp. I am having problem with my inbound traffic, where R2 is getting 100% utilization while R1 is only 25%. Can you help me come up with the most effective solution to load balance the INBOUND traffic. Thank you very much.


    Comment by erwin — February 13, 2019 @ 10:50 AM

  3. hi syed bai,

    Can you please guide me how to configure Bandwidth aggregation

    WAN 1= 100 WAN 2 = 150 OUTPUT i should get =250Mbps if i do speedtest also should get 250Mbps

    It is possible to configure in mikrotik.

    Thanks & Regards


    On Fri, Feb 1, 2019 at 10:37 AM Syed Jahanzaib Personal Blog to Share Knowledge ! wrote:

    > Syed Jahanzaib / Pinochio~:) posted: ” Scenario: We have a LAN environment > with our own email server [IBM Lotus Domino] hosted locally. Mikrotik > router is acting as our gateway router with /29 public pool & port > forwarding from mikrotik public ip to email server is configured. Barracud” >


    Comment by Girish Gowda — March 12, 2019 @ 9:24 AM

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: