Knowledge base
Three families of limit, applied at oncecriticalWritten by the HubmechanismA delivery is governed by the domain limits, the address limits and the connection limits simultaneously, and the strictest of everything that matches decides.One database, every node, no mastercriticalWritten by the HubmechanismEvery node reads the same 33 tables and none of them owns the data; a change is a row plus a reload message, and everything else follows from that.capacitycriticalWritten by the Hubdatabase tableOne row is a complete delivery profile: message and connection limits per domain and per address, seventeen SMTP timeouts, TLS mode and behaviour on unexpected responses.capacity_rulescriticalWritten by the Hubdatabase tableBinds a throttle profile to a domain, a sending address, a pool — or any combination, with blanks meaning "any", and each such combination belongs to exactly one profile.dkim_keyscriticalWritten by the Hubdatabase tablePrivate keys and their signing parameters: domain, selector, algorithm, canonicalisation, priority, expiry, extra headers, oversigning, ARC.dkim_patternscriticalWritten by the Hubdatabase tableMatches a key to messages by sender address, with five match types: exact, regular expression, substring, wildcard, global.pausedcriticalWritten by the Hubdatabase tableHolds deliveries for a destination, address, pool or tag, optionally until a given time, on one node or across the cluster.rest_tokenscriticalWritten by the Hubdatabase tableTokens that authorise the REST API — the only credentials it accepts, stored in clear text.suppressionscriticalWritten by the Hubdatabase tableAddresses and domains that are failed immediately, with a chosen code, checked at the moment of delivery.errorsimportantdatabase tableFails matching deliveries on purpose with a chosen SMTP code and description, and counts how often it has done so.flood_responsesimportantdatabase tableA throttle profile that switches itself on when a receiving server says something matching a pattern, and switches itself off after a set time.ipsimportantdatabase tableOne row per sending address, each with its own broker, exchange and queue — which is how a specific address can be given its own stream of mail.mtanamesimportantWritten by the Hubdatabase tableThe name each sending address announces in the SMTP greeting.mx_pattern_groupsimportantWritten by the Hubdatabase tableNamed groups that MX patterns belong to, usable wherever a domain can be named.mx_patternsimportantWritten by the Hubdatabase tablePatterns matched against a domain's MX records, so domains served by the same provider fall into one group.pool_ipsimportantWritten by the Hubdatabase tableOne row per address in a pool; an address may appear at most once.poolsimportantWritten by the Hubdatabase tableNamed groups of sending addresses, referenced by name in a message's job data.response_patternsimportantdatabase tableMatches what a receiving server said, narrowed by destination, sending address, pool and tag, in priority order.rewrite_actionsimportantdatabase tableWhat a rule does: set or remove a sending address or pool, add or remove tags, delay, redirect to a smarthost, patch the job.rewrite_triggersimportantdatabase tableSelects messages to be modified on consumption, with a time window, a precedence and an enabled flag.capacity_schedulesdatabase tableA named schedule that raises limits over days; left empty on our nodes by decision.external_mtasdatabase tableAddresses that are not on the machine: the engine binds locally, connects to a proxy, and mail leaves from an address the proxy owns.ip_rangesdatabase tableAddress ranges of receiving servers, grouped so that limits can apply to a whole network.localsWritten by the Hubdatabase tableIncoming addresses that are not relayed but published to a queue of their own — postmaster, abuse, feedback loops.response_actionsdatabase tableThe things that can happen when a response matches: pause, suppress, retry, add or remove an address or tag, set a property on the message or on the result.rewrite_conditionsdatabase tableExtra tests a message must pass — on the envelope, the subject, or any JSON property — before its rule applies.capacity_schedules_rulesdatabase tableBinds a schedule to combinations of sending address and destination domain.capacity_schedules_statesdatabase tableThe engine's own record of which day of a schedule each address-and-domain pair has reached.capacity_schedules_stepsdatabase tableOne row per step: from this day of the schedule, add this throttle profile to the ones already in force.dnsdatabase tablePins a hostname to an address, bypassing resolution for that name.ip_range_groupsdatabase tableNamed groups of receiver address ranges.notification_subscriptionsdatabase tableBrowser subscriptions for the console's push notifications.response_patterns_actionsdatabase tableMany-to-many link between triggers and actions, with its own ordering.sessionsdatabase tableActive management-console logins.vapiddatabase tableKey pair used to sign the console's browser push notifications.domain_maxmessagescriticalWritten by the Hubdatabase fieldHow many messages a minute may be sent to one destination domain, across every sending address.ip_maxmessagescriticalWritten by the Hubdatabase fieldThe per-address half of the limits: the same six quantities, counted for the pair of sending address and destination rather than for the destination alone.localipcriticalWritten by the Hubdatabase fieldThe sending address this rule applies to; empty means all of them.privatekeycriticalWritten by the Hubdatabase fieldThe PEM-encoded private key, stored in the cluster database in clear text.targetcriticalWritten by the Hubdatabase fieldThe destination being held — a domain, a receiving address, or * for everything the node sends.valuecriticalWritten by the Hubdatabase fieldOne address or one whole domain that mail is never delivered to.connection_minmessagesimportantWritten by the Hubdatabase fieldHow much work an existing connection must be given before the engine decides to open a second one.connection_offlinetimeimportantWritten by the Hubdatabase fieldAfter a failed connection or handshake, how long the engine stops trying that receiving address.domainimportantWritten by the Hubdatabase fieldThe destination this rule's profile applies to; empty means every destination.domain_maxconnectingimportantWritten by the Hubdatabase fieldHow many connections to one domain may be in the middle of being established at once — shipped at one.domain_maxconnectionsimportantWritten by the Hubdatabase fieldHow many SMTP connections to one domain may be open at the same time.domain_maxconnectsimportantWritten by the Hubdatabase fieldHow many new connections a minute may be opened to one domain.enforceimportantWritten by the Hubdatabase fieldNot what its name suggests: it records whether the signing algorithm was stated explicitly, and therefore whether the engine needs to ask DNS.expireimportantWritten by the Hubdatabase fieldThe moment a pause stops applying; zero means it stays until removed.flagsimportantWritten by the Hubdatabase fieldA bit field holding the console's behaviour switches — the ones with no column of their own.meaningfulimportantWritten by the Hubdatabase fieldThe companion mask to flags: one bit per switch, saying whether this profile decides it at all.patternimportantdatabase fieldWhat the receiving server said, matched against its response text.securityimportantdatabase fieldHow hard the engine tries to encrypt: never, opportunistically, required, or required with strict certificate checks.selectorimportantWritten by the Hubdatabase fieldThe label that tells a receiver which DNS record holds the public key for this signature.begindatabase fieldWith until, the period during which a rewrite rule applies; zero at both ends means always.canonicalizationWritten by the Hubdatabase fieldHow tolerant the signature is of whitespace changes in headers and body, as a pair of modes.codedatabase fieldThe SMTP result recorded for deliveries this rule stops.connection_maxidletimeWritten by the Hubdatabase fieldSeconds an unused connection is held open before being closed.connection_maxmessagesWritten by the Hubdatabase fieldHow many messages may be sent down one SMTP connection before it is closed and reopened.domain_maxidleWritten by the Hubdatabase fieldHow many established but unused connections to a domain are kept for reuse.finaldatabase fieldWhether remaining triggers are skipped once this one has matched.incomingWritten by the Hubdatabase fieldThe recipient pattern that makes incoming mail be published to a queue instead of relayed onward.maxqueueWritten by the Hubdatabase fieldHow many messages for this destination are held in the engine's memory at once.occurrencesdatabase fieldA counter the engine increments each time this forced error matches a delivery.pool_idWritten by the Hubdatabase fieldRestricts a rule to addresses in one pool.precedencedatabase fieldThe order in which rewrite rules are considered.protocoldatabase fieldThe protocol spoken to the proxy that owns the public address.timeout_connectdatabase fieldRepresentative of the seventeen per-stage timeouts: how long the engine waits at each step of an SMTP conversation.typedatabase fieldExact, substring, wildcard or regular expression.connection_featurestimedatabase fieldSeconds the engine caches what a receiving server announced in its greeting.domain_maxbytesdatabase fieldBandwidth ceiling towards one domain, counted in bytes per minute.precedencedatabase fieldNot a priority at all: the engine stamps the moment the profile was created and uses it to keep the console list in a stable order.priorityWritten by the Hubdatabase fieldWhere this signature is placed when a message is signed by more than one key.