<domain>
This is about our disconnect, not someone else’s. When the node is stopped, it closes connections — including those over which a message body is being transferred right now. This line decides whether it is allowed to do so.
The default true — allowed. The service stops quickly. The price is that the receiver got the message incompletely, and some mail servers deliver such a message anyway. On retry the node will send it again — the recipient will see two messages, one of them truncated.
false — not allowed. The transfer is completed, and no duplicates arise. The manual honestly names the price: stopping the node may take noticeably longer.
false — for nodes that are restarted often. The more often the service is stopped, the more often the default cuts transfers.
The default — for nodes that are stopped rarely and urgently. There a fast shutdown matters more, and a truncated message is a once-in-six-months event.
Look at the pairing with the bounce on disconnect. The same uncertainty from the other side is covered by bounce-upon-transfer-failure: it decides what to do with a message after someone else’s disconnect.
# a node that is restarted often: do not cut the transfer <domain *> allow-cancel-during-transfer false</domain>
what people get wrong and how it ends2 mistakes▶
our experience
§ 3.3.10.61
1 relation
pmta show settings gmail.com/vmta1 | grep -i allow-cancel
3 articles
◇How the policy for a receiver is assembledSettings are assembled from the most general pattern to the most precise; the order of blocks in the file means nothing.◇Backoff mode — the queue's second personalityA queue that a receiver has started refusing switches to a parallel set of limits, retries and routes — ten directives that act only in this mode.◇Reputation monitoring inside the nodeThe engine itself watches the receiving servers’ replies and changes the queue mode on a pattern match — a reaction within the connection, not through telemetry.