Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.54.2

relay-domain

Global

Recipient domains for which the node accepts mail from anyone
in the configuration this is a linerelay-domain local domainsinside the block Global
An inbound mechanism, not a right to send

The line names a recipient domain (or a domain pattern) for which the node accepts mail regardless of the sender’s address. The directive is repeated — one line per domain.

The manual describes the default as “local domains”: what the node already considers its own, including names declared with host-name.

This is an acceptance mechanism, not a sending one. The manual says directly: the line is useful mainly where the node handles inbound mail and passes it on. If the node only sends, there is no need to list domains at all — always-allow-relaying does the job there.

To list several domains at once, domain-macro is convenient: the list name is substituted into a template like yahoo.$topLevel.

The main trap is that the name promises something else. “Relay” in the name suggests the right to send through the node, and a sender who needs submission allowed reaches for exactly this line. It gives nothing: submission keeps getting refused, while the domains in the configuration create the impression of work done.

The other half: an open domain is open to everyone. By taking on a domain, the node commits to accepting mail for any address in it from anyone — and becomes a point to which anything can be sent, as long as the recipient is in that domain.

What the Hub does. It does not write it: it opens acceptance by addresses, not by domains — three pattern rules in the base configuration: complaints, asynchronous bounces and role addresses.

The difference is substantial. An open domain accepts mail for any address in it; a pattern rule accepts only for the addresses that match the pattern. For a node that handles service inbound mail and nothing else, the second is more precise.

Recommended values

What to set. Not everyone needs the line, and not always:

Value When
do not write it the node only sends — the most common case
a specific domain the node accepts inbound mail for this domain and passes it on
a pattern via a macro there are many domains and they are similar

If you need only a few service addresses — complaints, bounces, role addresses — relay-address is more precise: it opens an address, not the whole domain.

The syntax, repeatability, the “local domains” default and the caveat “useful mainly for inbound mail” come from the manual, § 3.3.1.54.2. The comparison with accepting by address is ours.
Example configuration
# the node accepts inbound mail for this domain and passes it on
relay-domain example.comrelay-domain some.other.domain
Mail for any address in the listed domains will be accepted from anyone. These lines do not grant the right to send through the node — the permission in the source block is responsible for that.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends2 mistakes▶

Reaching for this line when sending is what is needed

§ 2.3

What it costsIt solves the opposite task — accepting mail for your domains. The right to send through the node does not appear, and submission keeps bouncing.
How to spot itThe recipient domains are listed, yet submission gets relaying denied.
How to do it rightAllow submission with a line in the source block; leave the domain list for inbound mail.

Opening a whole domain for the sake of a few addresses

our experience

What it costsThe node accepts mail for any address in this domain from anyone — including addresses that do not exist and addresses found by guessing.
How to spot itRecipients of your domain that you never created appear in the queues.
How to do it rightOpen acceptance by addresses or patterns, not by the whole domain.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
relay-domain DOMAIN
Values
a domain name or a pattern; the line can be repeated
Default
local domains § 3.3.1.54.2
Applying
reload, no restart needed
Queue
will not touch what is already queued
Where to write it
Global
How many times
may be repeated
Everything here comes from the manual, with the section.
Inheritance
The directive is written at the root of the configuration file and applies to the whole node: it has no block, and no inheritance either. Acceptance cannot be restricted by source — that is the point: the domain is accepted regardless of who submits.
How to check on the node
The list is visible in the configuration, the behavior is checked by submitting from another machine:
grep -n 'relay-domain\|host-name' /etc/pmta/config
printf 'HELO test\r\nMAIL FROM:<a@example.com>\r\nRCPT TO:<anyone@your.domain>\r\nQUIT\r\n' | nc <node-address> 25
A 250 response means the domain is accepted. Also check an address that definitely does not exist: an open domain accepts mail for any address in it, not only for existing ones.
In the Hub
Cost of a mistake
reversible: harms only while it is set
Scenarios
Receiving inbound mail