Demo
Demo

Knowledge base

PMTA knowledge base›Block <address-list>›Directive§ 3.3.5.3

address-file

<address-list>

List addresses from a separate file
in the configuration this is a lineaddress-fileinside the block <address-list>
A long list — as a separate file

The line names a file; each of its lines becomes a list entry. Two forms are allowed — a full address and a local part without a domain, that is, exactly what address understands, except for patterns.

Why. A list of hundreds of lines does not bloat the configuration, is edited separately from it and can be updated by an external process.

A local part in the file means the same as in the configuration — a mailbox name in all domains. It is easier to make a mistake here: the lines in a file are short and uniform, and the difference between foo and foo@bar.com gets lost.

The main trap is that the addresses are stored in plain text. Anyone with access to the node can read the file, and it ends up in backups along with the configuration. For someone else’s suppression list this is an export of someone else’s database; where this matters, there is hashed-address-file.
What the Hub does. It does not write it: suppression works before the node in our setup, with its own list in the database. If lists on the node are ever needed, the file form is the right one: the Hub rewrites the configuration in full on every apply, and keeping a changing list of addresses in it would be inconvenient.
Recommended values

The value is a file path. What to consider when choosing a form:

Form When What you pay
address in the configuration a dozen entries the configuration grows
this file hundreds of entries addresses in plain text
hashed-address-file hundreds of entries that must not be shown you cannot read the list either

About the ceiling. The vendor advises against having more than five hundred patterns in one suppression list. The file does not accept patterns, so the limit applies to address lines with patterns in the same list, not to the file’s entries.

The entry format in the file comes from the manual (§ 3.3.5.3), the ceiling of 500 — from § 11.15. The note about file permissions is ours.
Example configuration
# the list is maintained separately from the configuration
<address-list foo>
    address-file /etc/pmta/suppression-address-list.txt</address-list>
The manual’s example. The file holds lines like foo, bar, baz@quux.com — the first two are local parts, that is, rules for all domains at once. Keep the file’s permissions no broader than the configuration’s: the addresses in it are in plain text.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends2 mistakes▶

Putting patterns in the file

§ 3.3.5.3

What it costsThe file accepts addresses and local parts, but not regular expressions. A line with slashes becomes an ordinary entry that matches nothing.
How to spot itThere are entries in the file, but no matches and no errors either.
How to do it rightWrite patterns as address lines right in the configuration, and keep the file for plain addresses.

Leaving the file with permissions broader than the configuration's

our experience

What it costsThe list of addresses in plain text becomes accessible to those who should not see it, and ends up in backups along with everything else.
How to spot itIt is discovered during an access review, not in operation.
How to do it rightFile permissions — the same as the configuration’s. Where the list must not be shown at all, use hashed-address-file.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
address-file <path>
Values
a file path; in the file one entry per line — a full address or a local part
Applying
reload, no restart needed
Queue
will not touch what is already queued
Where to write it
<address-list>
How many times
may be repeated
Everything here comes from the manual, with the section.
Inheritance
The line has no inheritance: it applies inside its <address-list> block. What is inherited is the reference to the list — suppression-lists in <source> merges by the source rule, in a pool it goes to the members, and a member’s own line overrides the pool one.
⇄

Related directives

2 relations

Does not work without

Lock down permissions on configuration filesThe file contains addresses in plain text, and its permissions must be no broader than those of the configuration itself. § 1.6.3

Can be replaced by

address<address-list>The same entry, but one per line of a file rather than in the configuration. § 3.3.5.3

Referenced from

hashed-address-file<address-list>The same file in plain form: readable and more flexible, but the addresses in it are visible. § 3.3.5.4

How to check on the node
The engine reads the file when the configuration is applied, so the file itself also needs checking:
wc -l /etc/pmta/suppression-address-list.txt
The number of lines should match the expected number of entries; blank lines and comments are not provided for in this file. Whether the list fired is visible from the refusal — its text contains the list name.
◇

What else to read

3 articles

◇Address lists — named and unnamedA list of addresses, domains, patterns or hashes; a named one is attached by directives such as suppression, an unnamed one lives inside an inbound mail processor.◇Configuration through the API and the file do not reconcileObjects created through the configuration interface cannot be edited in the file: two sources of truth about the configuration do not reconcile.◇The bounce category in accounting — configurable, not vendor-fixedThe bounceCat string in every accounting record comes from a pattern list that can be extended with your own rules and your own category names.

In the Hub
Cost of a mistake
reversible: harms only while it is set
Scenarios
Address suppression
Neighboring settings of the block <address-list>:hashed-addressaddressdomainhashed-address-fileAll 5 directives of the block →