We are changing our gateway, so we will be updating our external MX & A records.
Since our TLS cert refers to our current A record, what would be the best way to handle a change?
IE: current A record is mail.example.com mx records point to mail.example.com TLS cert is applied at the cluster level on our edge ESAs as mail.example.com
new A record will be gateway.example.com, we will update all mx to point to gateway.example.com and apply a new cert for gateway.example.com
What is the best way to do this to ensure minimal interruptions for Enforced TLS? I think we need to reduce all mx ttl to a minimal time, do the changes to the MX, apply the new cert at the same time, and then a few hours later, put the ttl back to where it was.
Any thoughts?
