Demo
Demo

Knowledge base

smtp-range verifiedcriticalWritten by the Hub

Who is allowed to connect

in the configuration this is a linesmtp-range: 192.168.0.0/16;127.0.0.1

Address ranges permitted to open an SMTP session; a hard gate applied before anything else in the conversation.

Values

Values
addresses and CIDR ranges, separated by ;
Default
192.168.0.0/16;127.0.0.1 · taken from the build
applying
restart required
where it can be set
in the config file · with a startup flag · as an environment variable

In detail

Not a relay policy — a door. An address outside the list is refused at the banner, before it can say who it is or what it wants. An empty value refuses everyone, which is the safe failure direction and the opposite of what an empty smtp-ip does. What the list grants is the right to *connect*. Whether a connected client may also send depends on smtp-auth: with authentication configured, being in this list is no longer enough, and a client that skips the login is told 554 Relay access denied at RCPT TO — measured on the stand in August from an address that was in the list.

What happens if you get it wrong

Widened to 0.0.0.0/0 without authentication.An open relay on a public address: anyone may hand the node mail and it will be sent from the customer's addresses, with the customer's reputation paying for it.inference · inference
Narrowed while a mailer is submitting.Submissions are refused at the banner and the sending application sees a connection error, not a policy message.inference · inference