Demo
Demo

Knowledge base

PMTA knowledge base›Block <pattern-list>›Directive§ 3.3.14.2

mail-from

<pattern-list>set by the Hub

A rule on the envelope return address that selects a stream or a priority
in the configuration this is a linemail-frominside the block <pattern-list>
The same name 1:<pattern-list><rewrite-list>— some of them are other settings, some are the same one
Selecting a stream by the return address — the most reliable rule

It matches the envelope return address: the one the sender named in the SMTP MAIL FROM command and to which bounces will return. The manual specifically notes that this is not the From header the recipient sees in a mail program. The difference is significant: the sender is free to write any header, while the envelope is set at submission.

The rule’s form is the directive name, a pattern in slashes and a result: virtual-mta=name, recipient-priority=N or call-to: with the name of another list. Results can be combined with commas.

The regular expressions are in the Perl dialect, and by default they are case-insensitive. Case sensitivity can be restored with the (?-i) modifier inside the pattern.

The main trap is an unescaped dot and a forgotten anchor. In the pattern /@shop.example.com/ a dot means “any character,” and the rule will match an address in the domain shopXexampleYcom. Without the $ anchor it will also match @shop.example.com.attacker.net. The correct form is /@shop\.example\.com$/.
What the Hub does. It writes it itself: the selection list of the working configuration is one such rule per sending domain, each sending the message to the stream of its “domain + address” pair. The dots in the domain are escaped, and there is an anchor at the end. The Hub deliberately does not write recipient rules — because of how they behave on messages with several recipients.

The Hub rewrites the return address to bounce@bounce.<domain>, but the rules match the original one: verified on a node on Sep 15, 2026 — messages submitted with the shared login went through the streams of their own domains, although accounting already showed the rewritten address.

Recommended values

How to write the pattern. Three things decide almost everything:

Technique Why
escape dots — \. otherwise a dot means any character
put a $ anchor at the end of the domain otherwise a decoy subdomain will match
match the domain, not the local part the local part changes, the domain does not

Rule order. The first match wins, so narrow patterns go above broad ones. A rule added below a broad one that already matches will never fire.

The rule’s form, the PCRE dialect and the difference between the envelope and the From header come from the manual. The pattern-writing techniques are ours.
Example configuration
# one rule per sending domain — this is how the Hub builds the list
<pattern-list mta-hub-senders>
    mail-from /@shop\.example\.com$/ virtual-mta=shop-example-com    mail-from /@news\.example\.com$/ virtual-mta=news-example-com
</pattern-list>
The dots are escaped, and there is an anchor at the end — otherwise the rule will also catch someone else’s subdomain. The envelope return address is matched, not From: a message with a spoofed From will still go out through the right stream.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends3 mistakes▶

Matching the From address instead of the envelope

§ 3.3.14.2

What it costsThe rule looks at MAIL FROM, but the pattern was written from the From header address. When a platform submits a message with a return address in a different domain than From, the rule never matches.
How to spot itThe rule looks correct, but messages go out through the default stream.
How to do it rightWrite the pattern from the return address the message is submitted with. Rewriting with rewrite-list does not affect the rule: the list matches the address before rewriting, even though the orig field in accounting already holds the rewritten one (verified on a node on Sep 15, 2026).

Not escaping dots in the domain

§ 3.3.14

What it costsA dot in a regular expression means any character. The pattern /@shop.example.com/ will also match someone else’s similar-looking domain — and someone else’s mail will go out through your warming address.
How to spot itIn accounting, return addresses from unexpected domains appear for the stream.
How to do it rightEscape the dots and put an end anchor — /@shop\.example\.com$/.

Putting a broad rule above a narrow one

§ 9.4.2

What it costsThe first match wins. The rule /@example\.com$/ placed above /@news\.example\.com$/ completely shadows the second — it will never fire.
How to spot itThe rule was added, the apply went through, and the behavior is the same.
How to do it rightBuild the list from narrow to broad. A generator should sort rules by pattern length, not by the order they were added.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
mail-from <regex-rule>
Values
a pattern in slashes and a result — virtual-mta=name, recipient-priority=N or call-to:name
Applying
reload, no restart needed
Queue
will not touch what is already queued
Where to write it
<pattern-list>
How many times
may be repeated
Everything here comes from the manual, with the section.
Inheritance
The rule has no inheritance: it acts inside its <pattern-list> block. What is inherited is the reference to the list — pattern-list is written in <source> and merges by the source rule, with a narrow block replacing the list entirely rather than adding to it.
⇄

Related directives

2 relations

Does not work without

pattern-list<source>The rule works only if the list is plugged into a source. § 3.3.7.42

Applies to

Selecting a sending address by message contentOne of the three kinds of rules: the return address, the recipient or a header is matched. § 3.3.14.2

Referenced from

The regular expression dialectThe directive that enables this mechanism. § 3.3.14

How to check on the node
What gets substituted into the rule is visible in accounting: the envelope return address field and the selected stream field side by side:
pmtaacctfind --output csv[orig,vmta,rcpt] /var/log/pmta/acct-*.csv | head -30
The orig field is the address the rule matches, if the source does not rewrite it. With rewrite-list, accounting holds the rewritten address, while the rule matched the original one: compare the pattern with the address the message was submitted with. If the stream comes from the default, most often it is the domain that differs, not the rule’s logic.
◇

What else to read

3 articles

◇Headers the sender uses to control deliverySix control headers let the submitting side choose a stream, tag a message with a job, set signing options and the key, the envelope identifier and the schedule; each is allowed separately and per source.◇Selecting a sending address by message contentRegular expressions are matched against a header, the return address or the recipient and select a sending address or assign a priority; lists can call each other.◇How a message gets into the engineSix described submission methods: extended SMTP, four language bindings and a directory the node watches on disk.

In the Hub
Value
The Hub picks it itself — pace, warm-up stage, metrics
Cost of a mistake
reversible: harms only while it is set
Scenarios
Sending address rotation · Connect a sending platform
Neighboring settings of the block <pattern-list>:headerrcpt-toAll 3 directives of the block →