Knowledge base
smtp-authcriticalWritten by the HubdirectiveWhere submitted credentials are checked; naming any scheme here makes a login mandatory for every client.smtp-checkWritten by the HubdirectiveWhich validations are run on accepted mail — SPF, DKIM, DMARC and spam scoring.smtp-passworddirectiveAccepted by the binary; the partner of smtp-username, superseded by smtp-auth.smtp-usernamedirectiveAccepted by the binary; the pre-5.x way of requiring a login, superseded by smtp-auth.smtp-auth-resultsWritten by the HubdirectiveWhether the verdicts from smtp-check are recorded in an Authentication-Results header, and for which recipients.Sign mail from a domaincriticalWritten by the HubprocedureKey, pattern, Store key, DNS — in that order, with two traps: the generated key is too short and a key without a pattern signs nothing.DKIM KeyscriticalWritten by the Hubconsole screenCreates signing keys and the patterns that decide which mail they sign — with three traps in one screen.dkim_keyscriticalWritten by the Hubdatabase tablePrivate keys and their signing parameters: domain, selector, algorithm, canonicalisation, priority, expiry, extra headers, oversigning, ARC.dkim_patternscriticalWritten by the Hubdatabase tableMatches a key to messages by sender address, with five match types: exact, regular expression, substring, wildcard, global.privatekeycriticalWritten by the Hubdatabase fieldThe PEM-encoded private key, stored in the cluster database in clear text.enforceimportantWritten by the Hubdatabase fieldNot what its name suggests: it records whether the signing algorithm was stated explicitly, and therefore whether the engine needs to ask DNS.selectorimportantWritten by the Hubdatabase fieldThe label that tells a receiver which DNS record holds the public key for this signature.canonicalizationWritten by the Hubdatabase fieldHow tolerant the signature is of whitespace changes in headers and body, as a pair of modes.priorityWritten by the Hubdatabase fieldWhere this signature is placed when a message is signed by more than one key.dkimimportantmessage propertySigning keys carried by the message itself — domain, selector, key and all the signing parameters — instead of being taken from the cluster database.Authentication statesdelivery stateRepresentative of the six authentication states, which occur only when sending through a smarthost.