Knowledge base

PMTA knowledge base›Configuration block§ 3.3.1

Global

critical

Settings for the node as a whole

Not a block but everything written outside blocks

Strictly speaking, this is not a block: such directives are written outside any blocks, usually at the beginning of the file. What unites them is their scope — they apply to the engine instance as a whole.

What belongs here. Connection ceilings for the whole node, the spool, incoming mail listeners, logging, the license, access to the web monitor, the address of the person responsible.

They have no inheritance — they are overridden neither in a receiver block nor in a sending address block. There is one value per node.

And that is exactly why same-named directives exist twice. The connection ceiling here and the connection ceiling for a receiver are different settings: the first limits the whole node, the second a single queue.

Example configuration

# node-level lines: no block, at the beginning of the file
host-id 5smtp-listener 0/0:2525
run-as-root no
include /etc/pmta/virtualhost.txt

The highlighted line and all the neighboring ones apply to the entire instance. The bottom one includes the file with the sending address blocks — our whole file layout rests on lines like it.

yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.

Block directives: 108

TLS 25

openssl-security-levelThe OpenSSL security threshold for the whole node smtp-server-tls-certificateset by the HubThe certificate the node presents when receiving mail http-tls-min-versionThe lower TLS version bound for the web monitor smtp-server-tls-min-versionThe lower bound of the TLS version on acceptance smtp-server-tls-ca-fileThe list of root certificates for verifying submitting clients smtp-server-tls-cipher-server-preferenceWhose preference order rules — the node’s or the client’s smtp-server-tls-ciphersThe cipher set on reception for versions up to TLS 1.2 smtp-server-tls-max-versionThe upper bound of the TLS version on reception http-tls-allow-sslv3deprecatedWhether to accept SSLv3 on the web monitor — the directive has no effect http-tls-allow-tlsv1deprecatedWhether to accept TLS 1.0 on the web monitor — a deprecated switch http-tls-allow-tlsv1.1deprecatedWhether to accept TLS 1.1 on the web monitor — a deprecated switch http-tls-allow-tlsv1.2deprecatedWhether to accept TLS 1.2 on the web monitor — a deprecated switch http-tls-allow-tlsv1.3deprecatedWhether to accept TLS 1.3 on the web monitor — a deprecated switch http-tls-ca-fileA file of trusted authorities for the web monitor’s client certificates http-tls-cipher-server-preferenceWho chooses the cipher on the web monitor — the node or the client http-tls-ciphersThe web monitor’s cipher set for versions up to TLS 1.2 http-tls-max-versionThe upper bound of the TLS version on the web monitor http-tls-request-client-certificateWhether to ask the client for a certificate when it connects to the web monitor http-tls-v1.3-ciphersuitesThe web monitor’s cipher suites for TLS 1.3 smtp-server-tls-allow-sslv3deprecatedWhether to accept SSLv3 — the directive no longer has any effect smtp-server-tls-allow-tlsv1deprecatedWhether to accept TLS 1.0 — a deprecated switch smtp-server-tls-allow-tlsv1.1deprecatedWhether to accept TLS 1.1 — a deprecated switch smtp-server-tls-allow-tlsv1.2deprecatedWhether to accept TLS 1.2 — a deprecated switch smtp-server-tls-allow-tlsv1.3deprecatedWhether to accept TLS 1.3 — a deprecated switch smtp-server-tls-v1.3-ciphersuitesCipher set for receiving over TLS 1.3

Mail submission 13

always-allow-relayingcriticalset by the HubAllow a source to submit mail for any recipients smtp-listenercriticalset by the HubWhere incoming SMTP is accepted pickupThe directory the node picks up messages from, and the directory for bad ones relay-addressset by the HubRecipient addresses for which the node accepts mail from anyone relay-debugRespond with a temporary refusal while acceptance rules are being checked relay-domainRecipient domains for which the node accepts mail from anyone smtp-await-slotWait for a slot or refuse an inbound connection above the ceiling total-max-smtp-inset by the HubThe ceiling on inbound SMTP connections domain-suffixWhat an incomplete address domain is completed with total-max-transmissions-apiCeiling of simultaneous Transmissions API connections pickup-retry-intervaldeprecatedRetry interval for the pickup directory — deprecated smtp-ipdeprecatedMail receiving address — the deprecated half of a pair smtp-portdeprecatedMail receiving port — the deprecated half of a pair

Diagnostics 11

log-fileset by the HubWhere the engine log lives log-auto-rotationWhether to switch the log file automatically at midnight log-rotateHow many log files to keep during rotation dummy-smtp-await-slotWhat to do when there are no slots for a new fake connection dummy-smtp-ipWhich address the fake receiver listens on dummy-smtp-latencyWhat network latency the fake receiver simulates dummy-smtp-portThe fake receiver’s port — which is also its on/off switch http-log-dataWhether to log the content of exchanges with the web monitor http-log-requestsWhether to log requests to the web monitor http-log-tlsWhether to log the course of the TLS handshake on the web monitor log-hires-timestampWhether to write milliseconds in the log

Access 9

http-accesscriticalset by the HubWho gets into the web monitor and with what rights http-api-keycriticalset by the HubKeys that grant full access to all of the node’s HTTP interfaces run-as-rootcriticalRun as root or as the pmta user http-csrf-protectionProtecting the web monitor from requests forged by someone else’s page http-redirect-to-httpsset by the HubWhether to forbid unencrypted connections to the web monitor log-file-world-readableWhether to make the log readable by all users on the system http-mgmt-sourcedeprecatedThe former way to grant an address access to the monitor — a deprecated directive http-strict-transport-security-max-ageHow long the browser remembers that the monitor is reached only over encryption no-http-mgmt-sourcedeprecatedThe former way to deny an address access to the monitor — a deprecated directive

Core 7

postmastercriticalThe address of the person responsible for the node includeset by the HubInclude another configuration file domain-macroset by the HubA name for a list of domains, substituted in other lines volume-audit-api-keyThe key for sending volume data under a volume-based license thread-reuseWhether to keep finished threads for reuse thread-max-priorityHighest process priority for the node’s threads thread-min-priorityLowest process priority for the node’s threads

Monitoring 6

http-mgmt-portset by the HubWeb monitor port track-inbound-perf-statsWhether to measure the duration of an inbound SMTP conversation track-outbound-perf-statsWhether to measure the duration of an outbound SMTP conversation dummy-smtp-update-statsWhether to mix fake traffic into the node’s statistics http-default-max-itemsHow many lines to show in the web monitor’s “Top” lists http-default-sort-orderHow to sort the web monitor’s “Top” lists

Proxies 4

smtp-proxy-source-hostcriticalOutgoing connections through a proxy, with their own identity proxy-include-tlvWhether to pass the queue domain to the proxy use-proxyThe list of proxies that sending goes out through proxy-protocolThe PROXY protocol version for connections through a proxy

Limits 4

total-max-smtp-outcriticalset by the HubThe ceiling of outgoing connections for the whole node max-memory-usage-percentStop accepting mail above a memory threshold ip-connection-limitA limit on simultaneous connections to a receiver’s address range mx-connection-limitA limit on simultaneous connections to one matching MX

Queue 4

spool-max-recipientsA ceiling on the number of recipients across all spool directories at once spool-delete-corruptedWhether to delete corrupted files found in the spool spooldeprecatedSpool directory — a deprecated form of notation spool-min-free-spacedeprecatedFree space threshold before refusing intake — a deprecated form

Message content 4

host-idset by the HubA node number that distinguishes its message identifiers from others’include-headers-fromA file of headers inserted into every message mailmerge-expands-undefined-variablesWhat to substitute for a mail merge variable without a value pickup-remove-dotWhether to remove the extra dot at the start of a line in pickup files

Bounces 4

custom-dsn-from-headerThe From header in generated reports, set verbatim dsn-failed-body-template-fromThe file the failure report body is taken from dsn-failed-from-templateThe From header template in failure reports dsn-failed-subject-templateThe subject template in failure reports

Accounting 3

track-time-first-attemptset by the HubWhether to record the time of the first delivery attempt time-first-attempt-hires-timestampMilliseconds in the first attempt time pmc-acct-min-free-spaceFree space threshold for the management console’s accounting files

Delivery 3

dummy-smtp-has-chunkingWhether the fake receiver announces the CHUNKING extension dummy-smtp-has-pipeliningWhether the fake receiver announces the PIPELINING extension dummy-smtp-has-verpWhether the fake receiver announces the VERP extension

Addresses 2

host-namecriticalThis node’s names and the name in the SMTP greeting smtp-source-hostcriticalLocal address and greeting name for outgoing mail

Routing 2

auto-mx-rollupWhether to roll up domains with the same set of lowest-priority MX records automatically aliasForward mail from one address to others

Reputation 2

enable-signalsWhere exactly event export is enabled enable-inline-seedingEnable automatic seeding and name the subaccount

DNS 2

name-serverWhich resolvers the node uses edns-udp-lengthEDNS payload size for routing queries

Signing 1

domain-keycriticalDKIM or ARC signing key for a sending domain

API 1

http-enable-api-configWhether to enable configuration editing over HTTP

Sending addresses 1

invalid-virtual-mta-fallbackA fallback stream for messages that named a nonexistent one

Compatibility

PowerMTA 6.0

described in the manual of this version · platform: any

The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.

◇

What else to read

3 articles

◇The activation key is a prerequisite for installation, not a step after itWithout an activation key from SparkPost support the engine neither installs nor runs, and the license tier sets the outbound connection ceiling: on Standard everything above 200 is ignored.◇Cloud restrictionsClouds restrict outbound mail on port 25 until you ask them to lift the limit, and mailbox providers treat their address ranges with suspicion.◇How to turn a sending plan into hardwareTwo constants for sizing any node: about 2 KB of memory per queued recipient and spool space proportional to the total size of the messages.

In the Hub

Cost of a mistake: reversible: harms only while it is set
Scenarios: Prepare a node for sending
Priority: critical