Mail / MX Configuration problems

Question

Hi folks
Warning - I'm a bit of a newb, but bear with me.  I have fiddled and experiemented and googled but have not found a resolution to my Mail / DNS / MX issues.
So some background - 2012 Mac Mini, Mavericks Server, behind NAT firewall with port forwarding enabled. 
Outward facing IPs are:
204.237.29.253
204.237.28.55
68.71.35.138
LAN IPs are:
192.168.0.254
10.0.0.1 - VPN for LAN
Issue in short - I can send and receive email from [email protected], but not [email protected]
The error I get when sending from [email protected] is:
                  The mail system
<[email protected]>: host kilbreath.ca[69.90.163.35] said: 550-Verification
   failed for <[email protected]> 550-No Such User Here" 550 Sender
   verify failed (in reply to RCPT TO command)
Reporting-MTA: dns; gonk.healthhive.ca
X-Postfix-Queue-ID: 2C87C46624F
X-Postfix-Sender: rfc822; [email protected]
Arrival-Date: Tue, 18 Feb 2014 19:39:27 -0500 (EST)
The error I get when sending email to [email protected] is:
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
[email protected]
   No Such User Here"
Using the GUI I configured a MX entry for this domain and my entry in named reads:
healthhive.ca.                        10800 IN SOA      healthhive.ca. admin.he$
                                                        2014021511
                                                        3600
                                                        900
                                                        1209600
                                                        86400)
                                      10800 IN NS       gonk.healthhive.ca.
                                      10800 IN MX       10 gonk.healthhive.ca.
admin.healthhive.ca.                  10800 IN CNAME    gonk.healthhive.ca.
ftp.healthhive.ca.                    10800 IN CNAME    gonk.healthhive.ca.
gonk.healthhive.ca.                   10800 IN A        10.0.0.1
                                      10800 IN A        204.237.28.55
                                      10800 IN A        204.237.29.253
                                      10800 IN A        192.168.0.254
mail.healthhive.ca.                   10800 IN CNAME    gonk.healthhive.ca.
ns1.healthhive.ca.                    10800 IN CNAME    gonk.healthhive.ca.
ns3.healthhive.ca.                    10800 IN CNAME    gonk.healthhive.ca.
vpn.healthhive.ca.                    10800 IN CNAME    gonk.healthhive.ca.
www.healthhive.ca.                    10800 IN CNAME    gonk.healthhive.ca.
Help - I'm at my wits' end!
Thanks - much obliged.
--Jeff

Answer 1

From that data dump shown: You won't want to include private addresses in public DNS — that doesn't work.   You probably won't want public IP addresses for a host with a local private address — though that'll work if your gateway-firewall-NAT box can "reflect" references to that public IP address back into your local network and your private address space.   You've got a variety of A records for that host, and — in the absence of multiple-path IP links and BGP — all but one of those are probably wrong,  Multiple A records do work, but probably not the way you seem to expect: the remote host querying the host name will get one of those addresses — effectively at random, as this approach is used for load balancing.   In any case, having private addresses in a public DNS space is definitely wrong.
Looking at the public DNS services for this configuration, the following is a problem — that mail. host shouldn't be in the public DNS (at all):
$ dig +short MX healthhive.ca
10 mail.
0 gonk.healthhive.ca.
$
This is also a problem — there's no IP address for the host that is the mail server, which means no mail can get to this server:
$ dig +short gonk.healthhive.ca.
$
There is no reverse DNS for any of the stated IP addresses, and that'll mean other mail servers will discard mail arriving from associated hosts:
$ dig +short -x 204.237.29.253
$ dig +short -x 204.237.28.55
$ dig +short -x 68.71.35.138
$
You probably also have the same domain inside and outside and — while not wrong — it's more difficult to manage than having an external domain and an internal domain, as you have two sets of DNS servers that are both "authoritative" for the same DNS domain, which means you'll have to track both DNS servers together as changes are made.  Again, that's possible, but it means you'll either need a NAT box that knows how to "reflect" IP references to your external address, or you'll need to keep private IP addresses for all the known hosts in the private DNS server, and the public addresses in the public DNS server.
You'll probably end up starting over here, if that's an option.  (Classically, once bad DNS gets embedded in various service configurations, it can be easier to start over than to change everything.)  Here is an overview of setting up internal DNS for OS X Server.  Once you have internal DNS sorted out and working — and again, I'd use a separate registered domain here and not the external domain — then you'll probably have your external DNS set up with one MX record for one external IP address — again, that's in the absence of BGP and/or multiple mail servers — for your mail server.  If you do have multiple IP addresses and multiple mail servers around, then you might see multiple MX records.  (But if it's all the same box, then adding host aliases onto the MX list usually doesn't get you much.)
Until you resolve the public DNS configuration and the public MX records, various other (remote) mail servers won't chat with this box.
What's your firewall here?  Is that device BGP-capable and do you have multiple ISP connections?  (I have various of those configurations around, but that's not typical entry-level gear found in these discussions.)
More generally, what are your goals here?