Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.27

smtp-listener

Globalcriticalset by the Hub

Where incoming SMTP is accepted
in the configuration this is a linesmtp-listener 0.0.0.0:25 implicitly, when no smtp-listener is declaredinside the block Global
Where the node accepts incoming SMTP

Declares the address and port on which the node listens for SMTP, and can bind a named source to them. There can be several listeners — one per address and port; 0.0.0.0 may be repeated, opening several ports on all addresses at once, and a range in CIDR notation is accepted instead of an address.

If you do not declare any, the node brings up a listener on its own — on 0.0.0.0:25. That is convenient on first launch and dangerous later: a listener on all addresses lives on where everyone has already forgotten about it.

The appearance of this line disables two old ones. The engine stops noticing smtp-ip and smtp-port altogether as soon as at least one listener is declared.

Binding a source to a listener gives a choice of sending address by entry point. The submitter chooses where to connect and thereby chooses which address its mail will leave from — without being able to set any headers. The manual warns right there: a relaying permission on such a source means that anyone who can reach the address will be able to relay — and that is an open relay.

The main trap. A node has only one port 25, and any other mail server on the same machine will take it. The node then does not start and writes the reason into a separate startup error file — the most common cause of “it did not come up after installation.”
What the Hub does. It declares two listeners on all addresses: 0/0:2525 for campaign submission and 0/0:25 for receiving complaints and bounces. The implicit listener is never used, and the Hub does not use source= binding — the source is chosen by the submitter’s address. In the firewall the installer opens only the submission port and the monitor port: it does not open port 25 — that is left to a human and recorded as a precondition in the template itself.
Recommended values

The submission port is not 25. On a sending node, port 25 is needed for receiving bounces and complaints, and keeping submission on it too means mixing two different doors. We separate them: 2525 for platforms, 25 for incoming reports.

The address in the line is not the sending address. It says where the node listens; which address it sends from is decided by smtp-source-host in the sending address block. Confusing the two is common on a node with several addresses.

source= binding is rarely needed and dangerous. It is appropriate when the entry point itself must choose the sending address. Without a pressing need it is better to choose the source by the submitter’s address — then the relaying permission does not go to anyone who can reach the port.

The syntax, the implicit listener and the open relay warning are the vendor’s. The “2525 for submission, 25 for receiving” split is ours.
Example configuration
# campaign submission — a separate port
smtp-listener 0/0:2525# receiving complaints and asynchronous bounces — port 25
smtp-listener 0/0:25
Two doors on all of the node’s addresses. Both share the common ceiling on incoming connections (total-max-smtp-in) — it counts connections for the node as a whole.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends4 mistakes▶

Declaring no listeners, assuming the node listens on nothing

§ 3.3.1.27

What it costsThe engine brings up an implicit listener on all addresses, and the node accepts mail where nobody planned it. The source rules in effect are the usual ones — that is, the defaults.
How to spot itA scan finds an open port 25 on a node whose configuration says not a word about listeners.
How to do it rightDeclare listeners explicitly, every single one, and check with the system that no others have come up.

Granting a relaying permission to a source bound to a listener

§ 3.3.1.27

What it costsAnyone who can reach the listener’s address will be able to relay — that is an open relay, and the manual calls it exactly that.
How to spot itSomeone else’s mail passes through the node; accounting shows domains you do not have.
How to do it rightDo not combine source= with a relaying right on a publicly reachable listener; choose the source by the submitter’s address and require a login.

Keeping submission on port 25

our experience

What it costsPort 25 is needed for receiving bounces and complaints. Combining the two deprives the node of the ability to restrict submission separately from receiving, and on top of that exposes submission to all the background noise that hits port 25.
How to spot itSubmission from the platform and incoming reports go through the same door; closing one without affecting the other is impossible.
How to do it rightGive port 25 to receiving and move submission to a separate port.

Opening the port in the configuration but not in the firewall

our experience

What it costsA listener line opens the port only in the engine. Reports and complaints arriving on port 25 do not get through at all, and you find out from silent statistics, not from an error.
How to spot itThe node listens on the port, but from outside the connection cannot be established: a timeout instead of a greeting.
How to do it rightCheck the port’s reachability from outside, not from inside the node: our installer opens submission and the monitor, and leaves port 25 to a human.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
smtp-listener CIDR:PORT [source=SOURCE-NAME]
Values
an address or a CIDR range with a port — for example 0/0:2525 or 1.2.3.4:25; optionally source=name, where the name refers to a source block
Default
0.0.0.0:25 implicitly, when no smtp-listener is declared § 3.3.1.27
Applying
reload, no restart needed
Queue
will not touch what is already queued
Where to write it
Global
How many times
may be repeated
Everything here comes from the manual, with the section.
Inheritance
There is no inheritance: listeners are a property of the process, not of a sending address. The line lives at the root of the file, outside blocks. It is picked up by pmta reload, but a port taken by another service will not be freed by a reload.
⇄

Related directives

4 relations

Depends on

total-max-smtp-inGlobalThe ceiling on incoming connections that this listener accepts. inference

Conflicts with

always-allow-relayingGlobalThe listener decides where the node can be reached from; the permission decides what those who reach it are allowed to do. § 3.3.1.27run-as-rootGlobalIt determines which ports are available to the listener: not root — only above 1024. § 2.2.1

Works together with

Who can submit mail and on what termsThe configuration block where the mechanism lives. § 3.3.1.27

Referenced from

smtp-ipGlobalThe supported form: address and port together, and there can be several such lines. § 3.3.1.27smtp-portGlobalThe supported form: address and port together, and there can be several lines. § 3.3.1.27How the node selects a source and combines its settingsThe source= parameter on a listener selects a named block and cancels address matching altogether. § 3.3.7smtp-service<source>The listener opens the port, and this directive decides whether to accept mail on it from the source. § 3.3.1.27source<smtp-user>The second reference to a named block: there the listener chooses it, here the account does. § 3.3.1.27await-slot<smtp-listener>The line applies to connections accepted on this listener’s address. § 3.3.17.1

How to check on the node
What the node actually listens on is shown not by the configuration but by the system:
ss -lntp | grep pmtad
The output shows the address and port of each listener. Empty output with the service alive means the listeners did not come up — the engine writes the reason into a separate startup error file, not into the regular log.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇Headers the sender uses to control deliverySix control headers let the submitting side choose a stream, tag a message with a job, set signing options and the key, the envelope identifier and the schedule; each is allowed separately and per source.◇The load balancer header at the entranceThe node reads the PROXY header at the start of an incoming connection and treats the address from it as the source; this works for both kinds of entry point.

In the Hub
Managed at
Infrastructure → Node parameters
Value
The Hub picks it itself — pace, warm-up stage, metrics
Cost of a mistake
disruptive: applying it interrupts the node
Scenarios
Receiving inbound mail · Node security · Connect a sending platform
Priority
critical
Neighboring settings of the block Global:always-allow-relayingrelay-addressrelay-domainpickuprelay-debugAll 108 directives of the block →