Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.48

proxy-protocol

Global

The PROXY protocol version for connections through a proxy
in the configuration this is a lineproxy-protocol 1inside the block Global
The same name 1:Global<virtual-mta>— some of them are other settings, some are the same one
The general level of a three-level setting

The line sets the protocol header version — 1 or 2. The default is 1.

There are three levels, and this is the most general one. The most specific is protocol-version in the proxy block itself; if it is not set there, the same line of the sending address is used; if that is not set either, this one applies, with the default 1.

The second version is needed for additional fields — only with it does passing the queue domain (proxy-include-tlv) work.

The version is chosen by the proxy, not by the node: set the one the proxy understands.

The main trap is setting it on the node and being surprised that some sending addresses behave differently. There are three levels, and either of the two lower ones silently overrides this one.
What the Hub does. It does not write it at node level: proxy-protocol 2 sits in every sending address that goes through a proxy — in the proxy-<tag> blocks of /etc/pmta/proxy.txt. The second version was chosen to pass the queue domain: by it the gate learns the receiver without looking into the SMTP conversation.
Recommended values

The value is chosen by what the proxy can do:

Value When
1 (default) the proxy is old or the queue domain is not needed
2 passing the queue domain is needed
Both versions, the default of 1 and the order in which the levels override each other come from the manual (§ 3.3.1.48, § 3.3.22.3).
Example configuration
# the second version and passing the queue domain go as a pair
proxy-protocol 2proxy-include-tlv domain
These two do not override the line in the proxy block itself — there it is the most specific.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends1 mistake▶

Setting the second version for a proxy that knows the first

our experience

What it costsThe proxy will not parse the header and will close the connection. The node will see an ordinary failure and move on to the next proxy or into retry.
How to spot itThe first proxy in the list never works.
How to do it rightMatch the version against the proxy’s configuration.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
proxy-protocol N
Values
1 or 2
Default
1 § 3.3.1.48
Applying
reload, no restart needed
Queue
will not touch what is already queued
Where to write it
Global, <virtual-mta>
How many times
once in the block
Everything here comes from the manual, with the section.
Inheritance
The line is written at the root of the file, in the Global section, and goes to all sending addresses until they set their own. The most specific level is the line of the same name in the <proxy> block itself.
⇄

Related directives

2 relations

Works together with

smtp-proxy-source-hostGlobalThe second way to configure a proxy; the protocol version is set for it by the same line. § 3.3.1.48

Affects

proxy-include-tlvGlobalPassing the queue domain works only with the second version. § 3.3.1.49

Referenced from

use-proxyGlobalThe protocol version the node will use to connect to proxies from this list. § 3.3.1.48proxy-protocol<virtual-mta>The level above: if not set here, the version is taken from there. § 3.3.1.48protocol-version<proxy>A level lower in precision: this line overrides it. § 3.3.22.3

How to check on the node
The version is not visible from the node side — look at the proxy:
tcpdump -A -i any -c 20 'port 5000'
The first version starts with the text PROXY TCP4 …, the second with a binary signature.
◇

What else to read

3 articles

◇Cloud restrictionsClouds restrict outbound mail on port 25 until you ask them to lift the limit, and mailbox providers treat their address ranges with suspicion.◇The sending address — what it is made ofA named set of everything that is a property of the address: which IP the message leaves from, how the node introduces itself, what it signs with and how fast it sends.◇A named proxy and three levels of its settingsThe block carries the proxy address, the external sending address, the protocol version, the field type and the number of attempts; the first two lines are required.

In the Hub
Cost of a mistake
reversible: harms only while it is set
Scenarios
Sending through proxies
Neighboring settings of the block Global:smtp-proxy-source-hostproxy-include-tlvuse-proxyhost-namedomain-keyAll 108 directives of the block →