Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.23

smtp-proxy-source-host

Globalcritical

Outgoing connections through a proxy, with their own identity
in the configuration this is a linesmtp-proxy-source-hostinside the block Global
The same name 1:Global<virtual-mta>— some of them are other settings, some are the same one
Sending through a proxy, the vendor’s way

Four words where smtp-source-host has two: a local address or range; the proxy with its port; the address the proxy will present to the receiver (optionally with a port); the greeting name.

It can be repeated — the lines add up to a set with round-robin rotation, as with the regular form. Only local addresses of the same IP version as the proxy get into the set: a version mismatch silently yields an empty or incomplete set.

Inside a sending address it overrides the general setting and rules out two others: neither smtp-source-host nor use-proxy may be used in the same sending address.

Why the vendor recommends this one rather than use-proxy. Two reasons, and the second matters more: the lines rotate round-robin; and all the machinery for disabling misbehaving addresses works by the proxy client address — the one the receiver saw — rather than by the local one. That is, disabled-source-ip-notify, reenable-source-ip-after and disabling an address by a rule count what actually makes sense.

The main trap. The node checks only the syntax of the client address: it cannot check whether the address is configured on the proxy itself. A typo here is not a configuration error but connections leaving from an unpredictable address — or not leaving at all, with diagnostics on the proxy’s side.
What the Hub does. It does not write it at node level: the Hub puts the line in every sending address that goes through a proxy — the proxy-<tag> blocks in /etc/pmta/proxy.txt, one per proxy. The form is the same as smtp-source-host, and the engine counts the disabling of misbehaving addresses by the proxy client address — so the address health logic carries over to proxies without rework.
Recommended values

The order of the words and what to put in them:

Word What it is What to watch
first a local address or CIDR range only addresses of the same IP version as the proxy
second the proxy and port a name or an address; the port is required
third the client address the receiver will see a port is allowed; the node does not check it
fourth the greeting name matches the reverse record of the client address, not the local one

The reverse record point is not a footnote but the essence. The receiver sees the proxy client address; the greeting name must match its reverse record. Run dig -x against the proxy address, not the local one.

The order of the words, the IP version restriction, the incompatibilities and counting by the client address — all from the manual. The dig advice is ours.
Example configuration
# local address → proxy → the address the receiver will see → name
<virtual-mta shop-via-proxy>
    smtp-proxy-source-host 10.0.0.5 proxy.example.net:5000 198.51.100.7 shop.example.com    proxy-protocol 2
</virtual-mta>
The receiver will see a connection from 198.51.100.7 and the greeting shop.example.com — it is this address that must match the reverse record. Neither smtp-source-host nor use-proxy is allowed in this block anymore.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends3 mistakes▶

Leaving smtp-source-host alongside it

§ 3.3.1.23

What it costsThe combination is forbidden: if the proxy form applies to a sending address, the regular one is not allowed in it. The error will surface when the configuration is applied, not when the file is edited.
How to spot itThe configuration reload fails, and the node stays on the previous version.
How to do it rightKeep only one of them in the sending address. And remember that the proxy form may be inherited from the node — then the regular one is not allowed, even if it is not visible nearby.

Mixing IP versions of the local address and the proxy

§ 3.3.1.23

What it costsOnly addresses of the proxy’s version get into the set. With a complete mismatch the set turns out empty — silently, with no warning.
How to spot itConnections are not established at all or leave from the wrong addresses, even though the configuration was applied without errors.
How to do it rightKeep the local range and the proxy on the same IP version. For two versions — two separate lines.

Checking the reverse record against the local address

§ 11.3

What it costsThe receiver sees the proxy client address, not the local one. A greeting name that matches the local reverse record matches nothing from the receiver’s point of view.
How to spot itChecks on the receiver’s side complain about a mismatch between the name and the reverse record, even though dig -x on the node shows a match.
How to do it rightRun dig -x against the third word of the line — the proxy client address.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
smtp-proxy-source-host CIDR PROXY-SERVER:PORT PROXY-CLIENT-IP[:PORT] HOSTNAME
smtp-proxy-source-host LOCAL-IP PROXY-SERVER:PORT PROXY-CLIENT-IP[:PORT] HOSTNAME
Values
a local address or CIDR, the proxy with a port, the client address (optionally with a port), a fully qualified domain name
Applying
reload, no restart needed
Queue
will not touch what is already queued
Where to write it
Global, <virtual-mta>
How many times
may be repeated
Everything here comes from the manual, with the section.
Inheritance
The directive is written at the root of the file, in the Global section, and sets the set for the whole node. Written inside <virtual-mta>, it replaces that set for this sending address’s messages. A companion ban applies as well: if the directive applies to a sending address — set in it directly or inherited from the node — then smtp-source-host and use-proxy are not allowed in that sending address.
⇄

Related directives

4 relations

Conflicts with

use-proxyGlobalIncompatible within one sending address, and the manual advises preferring this directive. § 3.3.1.23

Works together with

proxy-protocolGlobalSets the version of the PROXY protocol the node uses to talk to the proxy. § 3.3.1.48proxy-include-tlvGlobalAdds the queue domain to the PROXY header; requires the second version of the protocol. § 3.3.1.49

Can be replaced by

smtp-source-hostGlobalThe same job, but through a proxy; these two directives do not live together in one sending address. § 3.3.1.23

Referenced from

host-nameGlobalTakes part in the same resolution, including the case of selection by connection address. § 3.3.1.35check-spf-outbound<domain>The second way to set a sending address — when working through a proxy. § 3.3.10.2proxy-retry-after<domain>The line that makes all of this work: without sending through a proxy there are no proxy failures. § 3.3.10.47disabled-source-ip-notify<domain>When sending through a proxy, the notification concerns the proxy’s client address, not the node’s local interface. § 3.3.1.23enable-tq-record-for-proxy-failure<domain>The second way to configure a proxy; its failures are recorded the same way. § 3.3.10.107enable-source-ip-limits-on-sending-ip<domain>The difference between the local and the outgoing address appears only where sending goes through a proxy — that is, where this directive is set. § 3.3.10.86

How to check on the node
What matters is not the local address but the one the recipient will see. What is configured is in the configuration:
grep -rn 'smtp-proxy-source-host' /etc/pmta/
Compare the proxy client address in the line with the reverse record: dig -x 198.51.100.7 +short must return the name from the same line. The node does not check that the client address is actually up on the proxy — that is checked on the proxy itself.
◇

What else to read

3 articles

◇Backoff mode — the queue's second personalityA queue that a receiver has started refusing switches to a parallel set of limits, retries and routes — ten directives that act only in this mode.◇The sending address — what it is made ofA named set of everything that is a property of the address: which IP the message leaves from, how the node introduces itself, what it signs with and how fast it sends.◇How the node responds to the receiving server's wordsMatches SMTP replies against regular expressions and changes the queue mode on a match — the very trigger that all of the backoff mode machinery waits for.

In the Hub
Cost of a mistake
disruptive: applying it interrupts the node
Scenarios
Troubleshoot deliverability · Sending address rotation · Sending through proxies
Priority
critical
Neighboring settings of the block Global:proxy-include-tlvuse-proxyproxy-protocolhost-namedomain-keyAll 108 directives of the block →