Demo
Demo

Knowledge base

PMTA knowledge base›Mechanism§ 3.3.22

A named proxy and three levels of its settings

critical

<proxy>
One block — one outgoing address

The block describes one proxy, and it has two required lines: server — where the node should connect, client — which address the proxy must go out from. The port and the name in the second one are optional; the name defaults to the sending address’s name.

Three optional lines configure the protocol, and two of them have three levels: the block itself, then proxy-protocol and proxy-include-tlv on the sending address, then the same lines at the node level. The most precise one wins. The third, retry-attempts, has no levels.

This is one of two ways to write a proxy, and the manual presents them as two ways of doing the same thing. The second is smtp-proxy-source-host, a line instead of a block. The difference is where the link lives: the line carries the local address, the proxy, the external address and the name in one entry and rotates round-robin; the block is named, and sending addresses refer to it.

Hence the practical rule for choosing. One rented address per stream — a line is more convenient. Two or three proxies shared by many streams — blocks are more convenient.

The main trap is the name default. If you do not set the name in client, you get the sending address’s name. As long as it is correct for the rented address, all is well; as soon as the address moves or is rented from another supplier, the stream greets with one name while going out from an address whose reverse record says another — and receiving servers see it.
What the Hub does. It does not write it: of the two forms, the Hub’s gate took the other one — the smtp-proxy-source-host line in every sending address, which is also what the vendor recommends. There are no <proxy> blocks or use-proxy lines in the configuration.

🔎 The block form stays in reserve — for a second gate, should one be needed: the use-proxy list is a fallback, not a balancer.

Recommended values

The mechanism has no values of its own — five lines set them:

Line Required Levels
server yes one
client yes one
protocol-version no three
include-tlv no three
retry-attempts no one
The two required lines, the name defaulting to the sending address, the three-level chain and the presentation of the two forms as equivalent come from the manual (§ 3.3.22). The rule for choosing between the forms is ours.
Example configuration
# the block is named, sending addresses refer to it
<proxy mta-proxy-a>    server 10.1.2.3:5000
    client 16.70.55.233:0  client.hostname.com
    protocol-version 2
    include-tlv domain
</proxy>

<virtual-mta vmta>
    smtp-source-host 10.8.9.10 vmta.hostname.com
    use-proxy mta-proxy-a
</virtual-mta>
The name in the client line is set explicitly. Without it, vmta.hostname.com would be used — the sending address’s name, not the proxy’s outgoing address name.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends2 mistakes▶

Relying on the name default

§ 3.3.22.2

What it costsThe name is taken from the sending address. It may be wrong for the proxy’s outgoing address, and the stream will greet with a name other than that of the address it goes out from.
How to spot itThe external address’s reverse record does not match the greeting name.
How to do it rightSet the name in client explicitly.

Mixing the two ways of writing a proxy

§ 3.3.22

What it costsThe block and smtp-proxy-source-host are two ways of configuring the same thing, and use-proxy is incompatible with the latter. A configuration that has both will not pass validation.
How to spot itConfiguration validation complains about an incompatibility.
How to do it rightChoose one form: blocks when a proxy is shared by many streams, the line when each has its own address.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Inheritance
The block itself has no inheritance: it is named and attached by reference. But two of its lines take part in a three-level chain — block, sending address, node — and what is set here overrides both upper levels.
⇄

Related entries

4 relations

Does not work without

use-proxyGlobalThe line that assigns a declared block to sending addresses. § 3.3.22

Works together with

proxy-retry-after<domain>What happens when the proxy list is exhausted: the queue’s retry schedule. § 3.3.10.47

Can be replaced by

smtp-proxy-source-hostGlobalThe second way of writing a proxy: a line instead of a block, and they do not work together. § 3.3.22

Where you can see it

External addresses on one machine, nodes insideWhy this exists at all: external addresses on one machine, nodes on internal ones. § 11.3

Referenced from

The load balancer header at the entranceThe outgoing half of the same protocol: there the node sets the header, here it reads it. § 3.3.17.16server<proxy>The mechanism in which this line is half of the required minimum. § 3.3.22.1client<proxy>The mechanism in which this line is the second half of the required minimum. § 3.3.22.2protocol-version<proxy>The mechanism for which this line sets the protocol version. § 3.3.22.3include-tlv<proxy>The mechanism for which this line adds a field to the header. § 3.3.22.4retry-attempts<proxy>The mechanism for which this line sets the threshold for switching to a backup. § 3.3.22.5

How to check on the node
Check not the block but the result: which address and under what name the node went out:
dig +short -x 16.70.55.233
The reverse record must match the name in client. Receiving servers see the mismatch; the node will not report it.
◇

What else to read

3 articles

◇Cloud restrictionsClouds restrict outbound mail on port 25 until you ask them to lift the limit, and mailbox providers treat their address ranges with suspicion.◇The sending address — what it is made ofA named set of everything that is a property of the address: which IP the message leaves from, how the node introduces itself, what it signs with and how fast it sends.◇The sender names the stream for each messageThe message carries the name of the stream it should be sent through — the choice is made by the submitting program, not by the node configuration.

In the Hub
Cost of a mistake
disruptive: applying it interrupts the node
Scenarios
Sending through proxies
Priority
critical