High availability: the N+1 active-active cluster

MxGuard is built so that no single failure interrupts your mail. The design principle is blunt: lose any node, any database or any cache, and mail keeps flowing.

MX layer. An N+1 active-active cluster of MX nodes (mx1, mx2, mx3+) sits behind DNS MX-priority routing. All nodes accept mail simultaneously; there is no primary/standby to fail over.

Database. PostgreSQL 16 runs as a primary with a hot-standby streaming replica and automatic failover.

Cache. A Redis cluster with a 3-node Sentinel quorum manages reputation, recipient-verification and rate-limit data. Failed nodes are removed automatically via heartbeat monitoring.

Queueing. Each node keeps its own Postfix queue, isolated per customer, so one customer's backlog can never cascade into another's.

Because every tier is redundant and the MX layer is genuinely active-active, planned maintenance and unexpected node loss are both invisible to your senders.