Migrating from eFa

Welcome from the eFa world. This page walks through switching your inbound mail filtering from eFa to MxGuard with no downtime.

Before you start

Have to hand:

• Sign-in credentials to your DNS provider (where your domain's MX records live)
• The hostname of your real mail server — the one eFa currently delivers to (often the same hostname under a different port, or a subdomain like mail-internal.example.com)
• Your existing eFa box left running — for a week or so as your safety net

Step 1 — Make sure your real mail server accepts traffic from MxGuard

MxGuard will deliver scanned mail to your real mail server on the host/port you specified during signup. If your real mail server has a firewall or allowlist, make sure these MxGuard sending IPs can connect:

194.26.222.170    (mx1.mxguard.uk)
178.105.120.61    (mx2.mxguard.uk)

If your mail server is behind cPanel / Plesk / Mail-in-a-Box, this usually just works because they default to accepting inbound SMTP on 25 from anywhere. If you've locked it down to only accept from your eFa box, you'll need to add the above two IPs to the allowlist alongside.

Step 2 — Update your DNS MX records

In your DNS provider's control panel, find the MX records for your domain. Change them from your eFa box to:

Type    Priority    Host
MX      10          mx1.mxguard.uk.
MX      20          mx2.mxguard.uk.

Some DNS providers require the trailing dot, some don't — do whatever your provider's existing records do. Delete the old eFa MX entry so it doesn't compete. (You can keep your eFa box running; it'll just stop receiving new mail because nothing points there now.)

Set TTL to something short during the cutover — 300 seconds (5 minutes) is fine. Bump it back up to 3600 once you're settled.

Step 3 — Watch the cutover happen

DNS propagation is fast for most providers (under 5 minutes) and slow for a stubborn few (up to 24 hours). During that window, some senders' DNS resolvers still see the old MX (eFa) and some see the new one (MxGuard). Both work, nothing is lost.

Open the live feed in MxGuard. As soon as messages start arriving you'll see them stream in real time with verdict, score, and signals. The first one usually shows up within minutes.

Step 4 — Re-add your custom rules

MxGuard's sender allow/block lists work much like MailScanner's spam.whitelist.rules / spam.blacklist.rules but in a different format. For a typical eFa user this is a few dozen entries, ten minutes of copy-paste.

On your eFa box:

cat /etc/MailScanner/rules/spam.whitelist.rules
cat /etc/MailScanner/rules/spam.blacklist.rules

Then in MxGuard, go to Sender rules and add each entry. Wildcards like *@partner.com are supported and translate directly.

Step 5 — Decommission eFa

Once you've watched a week of traffic flow through MxGuard with no issues, shut down your eFa box. We don't need any closing handshake. The MX records are pointing at us now; eFa just goes quiet on its own.

Things eFa did that MxGuard does differently

eFa	MxGuard
MailScanner + SpamAssassin rule trees	Trained ML model, scored 0–1, plus complementary signals
MailWatch web UI for quarantine	/quarantine with one-click release/spam
SpamAssassin per-rule scoring	One model score; every signal visible in the live feed
Daily MailWatch digest by email	Daily digest with one-click release/spam links built in
ClamAV definitions to update	Nothing to maintain on your side
Patches yourself	Patches are ours

Stuck?

Email efa@mxguard.uk with your eFa hostname and what's not working. A real person will get back to you within a few hours (UK business time).