How to Load Balance SSL IMAP, POP3, and SMTP with HAProxy and Dovecot / Postfix

Load balancing encrypted email traffic (IMAPS on port 993, POP3S on port 995, and SMTPS on port 465) using HAProxy requires two critical mechanisms: SSL offloading at the load balancer and the PROXY protocol to preserve the client's real public IP address in Dovecot and Postfix logs.

Architecture: Encrypted Client → HAProxy (SSL Termination & send-proxy) → Dovecot / Postfix (Real IP Preserved)

1. HAProxy Configuration (haproxy.cfg)

frontend imaps_in
    bind *:993 ssl crt /etc/ssl/certs/mail.pem
    mode tcp
    default_backend dovecot_imaps

backend dovecot_imaps
    mode tcp
    server mail1 10.0.0.1:10143 send-proxy check

2. Dovecot PROXY Protocol Support (/etc/dovecot/dovecot.conf)

Configure Dovecot to accept the PROXY protocol header to log the real client IP:

service imap-login {
    inet_listener imap_haproxy {
        port = 10143
        haproxy = yes
    }
}
haproxy_trusted_networks = 10.0.0.0/24

High-Availability Outbound Email: Postfix smtp_fallback_relay with HAProxy SMTP Balancing

For organizations operating mail infrastructure in restrictive networks or corporate subnets with unreliable direct port 25 connectivity, combining HAProxy as an SMTP proxy relay with Postfix's smtp_fallback_relay directive guarantees reliable email delivery without dropped messages.

Flow: Primary MTA → Direct MX Delivery Failure → smtp_fallback_relay → HAProxy Relay VPS → Destination MX

1. HAProxy TCP Relay Configuration (haproxy.cfg)

listen smtp-relay
    bind *:2525
    mode tcp
    option tcplog
    timeout connect 5s
    timeout client 1m
    timeout server 1m
    server mta-out 10.0.0.1:25 check

2. Postfix Fallback Configuration (/etc/postfix/main.cf)

Instruct Postfix to attempt direct MX delivery first, but automatically route through the HAProxy relay if destination mail servers are unreachable:

# Automatic fallback routing to HAProxy relay on port 2525
smtp_fallback_relay = [relay.example.com]:2525