Demo
Demo

Knowledge base

PMTA knowledge base›Block <address-list>›Directive§ 3.3.5.2

hashed-address

<address-list>

An address hash instead of the address itself
in the configuration this is a linehashed-addressinside the block <address-list>
A list the node enforces but cannot read

The line takes not an address but its hash. The derivation rule is exact: the address is lowercased, hashed with SHA256, and the result is encoded as BASE64URL. During the check the engine does the same with the message’s address and compares the two strings.

There is no need to compute the hash by hand — a tool comes with the product: pmtahashedAddress on Linux, hashedAddress.exe on Windows. It also lowercases the address, so test@FOO.com and test@foo.com give the same hash.

Only whole addresses. No local parts, no domains, no patterns: pattern matching does not apply to hashes at all.

What it is all for. A suppression list can be stored, transmitted and backed up without containing a single readable address.

The main trap is expecting the flexibility of a regular list from hashes. A line like /^bounce@/ in hashed form will match nothing and raise no error: the engine compares hashes of whole addresses rather than parsing patterns. The list looks configured and stays silent.
What the Hub does. It does not write it: the Hub keeps its blocklist in its own database and does not hand it to the node. The form, however, is exactly what will be needed in one specific case — when a client demands that its suppression be respected but does not want to hand over the addresses: the node will enforce a list it cannot read, and neither the configuration file nor its backup will reveal the addresses.
Recommended values

The value is a hash string obtained with the bundled tool. The choice between the open and hashed forms:

Form Flexibility Who can read the list
address address, local part, pattern anyone with access to the file and the backup
hash whole addresses only nobody

The practical consequence: a hashed list can be neither browsed nor checked by eye. All you can do is compute the hash of a specific address with the same tool and search for the string.

The hash derivation order, the tool names and the ban on patterns come from the manual (§ 3.3.5.2). The advice about a client’s list is ours.
Example configuration
# the configuration file has not a single readable address
<address-list foo>
    hashed-address iZ0zh6XFp1VdUdLwoLe1Djl_5IH9mlj6-zibfclOEfY~</address-list>
The hash from the manual is test@foo.com. It can be computed with the command pmtahashedAddress test@FOO.com: the tool lowercases the address itself, so the case in the source address does not matter.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends2 mistakes▶

Putting a pattern or a domain into a hashed list

§ 3.3.5.2

What it costsPatterns do not apply to hashes, and a domain is not a whole address. The line will match nothing and raise no error — the list silently does not work.
How to spot itSuppression never fires once, and there are no errors in the configuration.
How to do it rightIn hashed form — only whole addresses. Keep everything else in a regular address list.

Computing the hash the wrong way

§ 3.3.5.2

What it costsThe form is strict: lowercase, SHA256, BASE64URL. Hexadecimal notation or regular BASE64 give a different string, and there will be no matches.
How to spot itThe hash is computed and in the list, but suppression is silent.
How to do it rightUse the bundled pmtahashedAddress: it does all three steps itself and gives exactly the form the engine expects.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
hashed-address <hash>
Values
a SHA256 hash string in BASE64URL encoding, derived from the lowercased address
Applying
reload, no restart needed
Queue
will not touch what is already queued
Where to write it
<address-list>
How many times
may be repeated
Everything here comes from the manual, with the section.
Inheritance
The line has no inheritance: it applies inside its <address-list> block. What is inherited is the reference to the list — suppression-lists in <source> merges by the source rule, in a pool it goes to the members, and a member’s own line overrides the pool one.
⇄

Related directives

2 relations

Works together with

hashed-address-file<address-list>The same for a long list — the hashes are read from a file, one per line. § 3.3.5.4

Can be replaced by

address<address-list>The same entry in open form: more flexible, but readable by anyone with access to the configuration. § 3.3.5.2

Referenced from

privacy-policy<acct-file>There the same technique is used to store list addresses; here it hides them in accounting. § 3.3.5.2

How to check on the node
You have to check through the tool — a hashed list cannot be read by eye:
pmtahashedAddress test@FOO.com
The resulting string is searched for in the list by exact match. If it is not there while suppression was expected, there are two possibilities: the address did not get into the list, or the list holds its open form rather than the hash.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇The group that grants management rightsMembership in the pmta group gives an unprivileged user the right to call the node’s commands and use submission.◇How the node selects a source and combines its settingsA connection falls under all source blocks whose addresses cover it, and they act merged — the narrow one overrides the wide one; named blocks are attached only by direct reference.

In the Hub
Cost of a mistake
reversible: harms only while it is set
Scenarios
Node security · Address suppression
Neighboring settings of the block <address-list>:addressaddress-filedomainhashed-address-fileAll 5 directives of the block →