critical
The record appears when the destination server accepted a message for a specific recipient. One per recipient — which makes this record the most numerous of all, and any sending volume figure is ultimately calculated from it.
The record type in the line is d. The first field of every accounting line names the type, and that is how records are parsed: d — delivered, b — bounced, t — temporary failure.
There are thirty-six fields, twenty-two written by default. The set is the same as for bounce and temporary failure records — which is convenient: a parser for all three types is written once.
What the record contains. The outcome and its code, the time of queuing and the time of the event, the sending address, the job, the size, transport security and proxy data, if there was one. That is, enough to answer “how much went out,” “from which address” and “was the transfer encrypted.”
What it does not contain. What happened to the message after the destination server accepted it: whether it landed in the inbox, whether the recipient opened it. The record speaks only about the transfer.
It arrives as a stream through a webhook, not by reading a file: the node is configured to hand records to the Hub as they appear.
⚠️ That is exactly why we show deliverability, not the inbox rate — we have no data about the folder and cannot have any: the node does not know about it. Inbox monitoring would require seed mailboxes and IMAP polling, and that is a separate task.
What this record can and cannot measure:
| Question | Does the record answer it |
|---|---|
| how many messages the destination servers accepted | yes, this is exactly it |
| from which address and for which job | yes, the fields are there |
| whether the transfer was encrypted | yes, transport security is recorded |
| whether the message landed in the inbox | no — the node does not know this |
| whether the recipient opened it | no — that is another source |
Twenty-two fields out of thirty-six is the default, not the limit. The set of written fields is configurable; expanding it should be done deliberately: the record is the most numerous, and every extra field is multiplied by the sending volume.
Three record types share the same field set — delivery, bounce and temporary failure. A parser written for one type reads the other two as well.
# a delivery accounting line: the type in the first field d,2019-02-08 21:53:41+0000,2019-02-08 21:53:41+0000,CB-A=example.com@bounce.foo.com,# A@example.com,,delivered,2.0.0,smtp;250 OK,mail.example.com (10.1.2.3),...
what people get wrong and how it ends3 mistakes▶
§ 12.2
§ 12
§ 3.3.10
3 relations
Sending addressThe field with the sending address name — it shows which queue delivered the message. § 12.2.1Encryption versionThe field with the encryption version: whether the transfer was encrypted and how exactly. § 12.2.1How many attempts there wereThe field with the number of attempts: how many times it had to be retried before success. § 12.2.1
What the node tells about itself and through which channelsThe accounting record the answer to “what happened to the message” is made of. § 1.4pmc-acct-min-free-spaceGlobalThe same events that go to the node’s accounting are also written for the console — as separate CSV files. inferencedisable-acct-records<domain>The delivery record — the one written even for messages sent nowhere. § 3.3.10.8assume-delivery-upon-data-termination-timeout<domain>A delivery record made on an assumption is indistinguishable from a real one in accounting. § 3.3.10.102The telemetry contractThe most frequent record in the stream: a message was delivered to the recipient. § 3.3.11records<acct-file>The record type chosen most often: successful delivery to the recipient. § 3.3.11.11
head -3 /var/log/pmta/acct-*.csv cut -d, -f1 /var/log/pmta/acct-*.csv | sort | uniq -c
3 articles
◇What the node tells about itself and through which channelsSeven observation surfaces: the web monitor, the console in four formats, the log, accounting, accounting search, metrics and export to external analytics.◇The telemetry contractOne block describes the accounting output in full: which record types, which fields, where they go, how files rotate and what gets anonymized.◇How an accounting record is structuredHow an accounting record is structured: the record type in the first column, then the fields, whose composition is configurable.