Each node is able to process hundreds of thousands of emails per hour without introducing delays. Additional servers can be added to a Node within minutes to increase capacity should the need arise.

The MX Nodes store their configuration information in an LDAP database, whilst log files and various elements of the spam scanning system are stored in a relational database. LDAP and the database are set-up to replicate in real time which means that should an administrator make changes to domain settings, these changes are picked up almost instantly by all MX Nodes. The use of a replicated architecture means that MX Nodes can be placed at various strategic geographic locations for increased performance and redundancy and allows the system to scale very quickly. Currently, two MX nodes are located in the primary data centre, whilst a third is located in the USA with other Nodes planned for other UK and European locations during the first half of 2009.

MX Nodes perform recipient address verification against the destination servers to protect against directory harvesting attacks.

Email domains can be configured with a range of delivery options including: multiple primary & secondary destination servers, archiving to single target mailbox, spam rejection/identification settings, white/black lists and file type blocking.

If email domains are configured with Virus and/or Spam Protection Services on their account, the MX Nodes are responsible for handing the email over to the Spam & Virus Scanning System where it is subjected to a comprehensive range of checks by multiple different scanning engines and techniques to ensure the email is OK before processing it further.

If email domains are configured with Continuity Email Services on their account, the MX Nodes also handle Continuity Email routing such as cloning a copy of incoming emails to the Zimbra Continuity Mailboxes, forwarding original emails to the destination servers and dealing with queueing of emails during a continuity incident and subsequent repatriation of sent items once the client server(s) comes back on-line.

Once an email has been accepted, the MX Nodes will forward the emails on to their intended destination servers - either at the customer site or to the Zimbra Mailboxes servers.

This means that recovery from physical server failure can be accomplished very quickly as Mailbox Servers can simply be restarted on a spare physical host. All mailbox data is also stored on on the SAN for maximum reliability.
Zimbra mailboxes are stored on Mailbox Servers which boot directly from a highly redundant Storage Area Network (SAN). This means that recovery from physical server failure can be accomplished very quickly as Mailbox Servers can simply be restarted on a spare physical host. All mailbox data is also stored on on the SAN for maximum reliability.

SAN snapshots are taken regularly throughout the day, nightly backups are made of all mailboxes to a separate backup system and these backups are transferred off site to two separate data centres where they are stored for 30 days.

Multiple Data Suites

As well as servers with redundant power supplies and network connections, racks with redundant A/B power feeds and a true Tier III, enterprise class data centre, In-Tuition are careful to distribute key equipment across two independently powered suites with the Data center for additional resilience.

Storage Area Network (SAN)

Lefthand Networks Logo

Our SAN is based on Lefthand Networks SAN/iQ® storage software. The patented architecture distributes intelligence across storage nodes, then stripes data over the entire cluster, eliminating any single point of failure.

The SAN/iQ® implementation consists of multiple storage nodes, each with 15,000 RPM, SAS drives, configured with RAID 10. Whilst RAID 10 offers the best combination of redundancy and performance, a lot of space is wasted because data is striped and mirrored across all available drives. For additional redundancy, In-Tuition configure the Lefthand software to mirror all mailbox data across at least two nodes which doubles the required storage space. In practise, therefore, for each 1GB of mailbox data, actually requires 4GB of raw SAN storage space (not including snapshot storage space requirements which vary according to usage) plus approximately 8GB of backup storage space.

Clearly, we could increase capacity, and therefore lower costs by a factor of 4, by reducing the amount of redundancy employed. However, given the critical nature of email data, our policy is for maximum realistic possible data protection.

SMTP Smart Hosts share the same multi server design and very similar system architecture to our MX Nodes, except that they are completely separate systems and deal with all outgoing email sent via through network. This separation of incoming MX Nodes from outgoing SMTP Smart Hosts gives a greater degree of control and flexibility.

All email sent from the Zimbra mailbox servers is sent via the SMTP Smart Hosts, regardless of whether it is destined for internal user or not. Customer's who have purchased the appropriate service are able to use our SMTP Smart Hosts for relaying all mail.

Various advanced configuration options are possible, for example, all email for a specific domain can be relayed on to a third party smart host which allows for a great degree of flexibility.

The data centre is fed by physically diversely routed 1Gb fibre connections provided by Kingston Communications, with transit provided by Level 3, Above Net and MFN. 3 state of the art Cisco routers running the BGP 4 protocol power the backbone of the network with web and email services connecting via redundant network paths and protected by sophisticated firewalls, intrusion detection and monitoring systems. The entire network is designed to operate without interruption even in the event of a component failure.

* 24 x 7 network monitoring by Network Operations Centre (NOC).

* N + 1 network design as standard.

* 2 x Fibre Optic pairs from separate fibre providers connecting data suite to core network provider.

* Core network provider peers with LINX, LONAP & LIPEX, transit via Level 3 and Metromedia Fibre Networks.

Perimeter & Building Security

• Perimeter access control - cars must be registered to enter estate.

• Car Park manned 24/7 with manned barrier entry control.

• Building manned 24/7 by a security force who monitor the inside and outside of the building using CCTV. The guard station is hardened for protection from firearm attack.

• Access to the building is via man trap door.

• Identity cards are visually and electronically inspected and proximity cards are required to move around the building with access strictly limited to only necessary areas.

Building management system

The environmental controls for the accommodation are managed by a Trend Building Management System. This system gives operators the ability to change set points, monitor the status of various pieces of mechanical equipment, and make management decisions about the environmental stability of the accommodation from any off-site location.

Data suite security

• Man trap doors protect the data suite.

• CCTV monitoring of data suite area.

• Each rack is independently secured.

• Access strictly limited to authorised technicians only.

• NOC staff on hand to monitor network and provide level three assistance.

Mains Power & UPS Capacity

Power is provided by a London Electricity 11kV service. Two feeders, diversely routed from the primary substation, supply the switch room that exclusively services the data suite. The two feeders give 100% redundancy to the supply cable.

Three 2.8MVA, 11kv/415V transformers each supplied via their own MV feeder, supply independent strings of LV switchgear, designed so that any one string may be serviced at any time without interruption to critical or essential loads. The transformers are also configured so that any one transformer can be serviced at any time with the remaining transformers able to supply all three strings of switchgear.

The data suite has three rotary UPS systems to provide N+1 redundancy, each rated at 1,100kVA. All three UPS systems work together to distribute dual source, 3 phase 415V clean power to the suite. The UPS is capable of supporting a combination of utility and generator sources for power. Thus, the systems are able to be load tested frequently, which helps to assure the reliability of the facility. Each UPS system can be exercised independently or together with each other. Each UPS can be taken off-line individually and tested with a load bank while maintaining UPS power to the accommodation.

Power Distribution & Generator Backup

Power distribution to the data suite is through Piller Automatic Static Transfer Switches (ASTS) and into 415 volt Power Distribution Units (PDUs). The purpose of the ASTS is to select the preferred power source and deliver that power to the PDU. The PDU delivers power to the data suite racks via distribution boards which provide dedicated 16A, 240V circuits. Our racks are equipped with two 1,200V 16A circuits provisioned from different PDUs for redundancy.

Each UPS system is supported by a 2,500HP Caterpillar diesel engine that also generates power for essential loads such as cooling plant. All essential plant has dual supplies with automatic changeover. The essential distribution is designed to enable the service or maintenance of one generator without compromising the back-up supply to the essential plant.

Fuel is stored on site in two 30,000 litre below-ground diesel fuel tanks located in secure areas along the side of the building. Dual fuel supply systems ensure reliable fuel delivery to the day tanks for each diesel engine.

Heating, Ventilating & Air-Conditioning (HVAC)

The data suite is serviced by 5 x 60kW Liebert-Hiross down flow air conditioning units that pressurise raised floor areas. Conditioned air rises up through cut outs under the racks and through floor grills in the circulation routes.

Air is re-circulated at high level back to the down flow units. The down flow units are equipped with chilled water coils and supply fans. The cooling capacity is modulated by way of 2-port valves on the chilled water pipe work controlling the return air temperature. To assure reliability from a power standpoint, units are alternately fed from separate switchgear locations.

The chilled water is generated by 5 x. 500kW air cooled York screw chillers which are provided on an N+1 basis. The N+1 criteria ensures that redundancy is created by having one more chiller than is required for the total maximum load. Chilled water is distributed around the data suite via a flow and return ring main system that is fed by diverse routings. This ensures that should any section of pipe work fail, that section can be isolated and the flow maintained to all other parts of the installation. The chilled water pumps are provided on an N+1 basis and are fed from a dual busbar control panel, which in turn has dual feeds. The ingress of pollutants and contaminants to the data halls is controlled by pressurising the data halls by roof mounted air handling units. These air handling units are equipped with ultrasonic humidifiers to control the data halls Relative Humidity level.

The chilled water piping under the raised floor is monitored by a leak detection system. Any leak will activate this system and will be located by control panel graphics. A leak occurring directly under one of the down flow units will cause that unit to shut down to isolate the leak.

Fire protection systems

The data suite is provided with a pre-action fire protection system and an FM200 gas fire suppression system. The FM200 system comprises gas cylinders positioned at the data suite perimeters with distribution pipe work to cover the room volume and floor void. The FM200 system is provided with safety interlocks to protect against an accidental discharge.

The pre-action sprinkler system serves only the ceiling voids and comprises a system of distribution pipe work filled with compressed air. Should any of the sprinkler heads be subjected to temperatures encountered in fire conditions the system charges with water and extinguishes the fire.

Any incipient fire will be detected by a VESDA air sampling system which covers the floor and ceiling voids, and the room space. The VESDA is interlocked with the conventional smoke detection installation to arm the FM200 system in the event of a double knock.

Rack and Server Specifications

All of our racks and server equipment are specified for maximum redundancy based on experience gained from many years of running highly reliable systems:

• A and B power circuits. Power feeds come from different Power Distribution Units (PDU) for redundancy - if one power circuit should fail, the other circuit is available. Power interruptions are most often as a result of servers' power supplies failing. This can cause a power spike, which then activates the trip switch on the PDU.

• Servers and Network Switches have two power supplies, one plugged into the A power circuit, the other plugged into the B circuit. If a circuit should fail, the other power supply is already on-line therefore continuity of power supply is maintained with zero downtime.

• Racks and Servers have remote controlled power cycling facilities so that engineers can easily power cycle equipment.

• Servers are connected to at least two core network switches and each connection is at least one 1Gb.