# SMTP & IMAP proxy based on domain (pass-through)

**URL:** <https://discourse.haproxy.org/t/smtp-imap-proxy-based-on-domain-pass-through/5480>\
**Category:** Help!\
**Created:** [July 15, 2020, 8:54pm UTC](https://discourse.haproxy.org/t/smtp-imap-proxy-based-on-domain-pass-through/5480 "2020-07-15T20:54:55Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [July 16, 2020, 12:18pm UTC](https://discourse.haproxy.org/t/smtp-imap-proxy-based-on-domain-pass-through/5480/2 "2020-07-16T12:18:53Z")

</div>

No, this is not really possible, because you have to support a) cleartext and b) STARTTLS, neither allows SNI based routing decisions, because the SNI value, if it exist at all, is not in the first packet.

You can only do this with implicit TLS, meaning imaps on TCP Port 993 and SMTP submission with implicit TLS on port 465.

Port 587 is unencrypted until you start the TLS session with STARTTLS. It’s therefor impossible to route based on SNI.

> [@kolos121](#):
>
> domain (sni)

I don’t think SNI contains the domain. It usually contains the hostname you are connecting to.

I’m also not sure if MUA’s really do SNI, and if it’s supported widely enough so that it’s actually usable.

---

_[View the full topic](https://discourse.haproxy.org/t/smtp-imap-proxy-based-on-domain-pass-through/5480)._