Demo
Demo

Knowledge base

PMTA knowledge base›Recipe

An address of its own for a platform that does nothing for it

Separation that needs no changes on the other side

The task. A connected platform hands over mail via SMTP and cannot be modified to add headers — yet its messages must go out from their own sending address, not the node’s default one.

What it is made of:

  • vmta-select-pattern — a rule by the platform’s return address;
  • vmta-select-listener — instead: its own submission address and port;
  • vmta-select-source-ip — instead: a sending address by the address the platform connects from.

The parts have different scopes. All three act through the <source> block, and a source has exactly one rule list: if a source serves several platforms, their rules live in one ordered list.

How they interact. Three paths to one goal, and the choice depends on what is stable about the platform. The return address is usually the most stable and costs nothing. The connecting address is reliable only if it is not shared. A dedicated submission endpoint is the most reliable, but costs an address and a listener per platform. All three rank below what the platform says itself: should it start setting X-Virtual-MTA where process-x-virtual-mta is allowed, the scheme will silently stop working.

The main trap is matching the address from the From header. It changes from campaign to campaign, while the mail-from rule in <pattern-list> checks the envelope return address — that is the one to use, anchoring the domain to the end of the address.
What the Hub does. It applies the main path: the pmta-pattern list routes a message by the return address domain to the stream of the “domain and address” pair, and the platform does not need to change anything. The Hub does not give a platform its own submission address, and by-smtp-source-ip in the general source serves as the bottom layer, not as a replacement for the list.
Recommended values

How to choose the method:

Method Stable if Cost
by return address the platform’s return domain is constant nothing
by submission endpoint the platform has its own submission address or port an address and a listener per platform
by connecting address the platform connects from an address it shares with no one nothing, but fragile on someone else’s infrastructure
The selection methods, their order and one list per source come from the manual (§ 9.4.2–9.4.4, § 3.3.7.42). The comparison is ours; the scheme is a hypothesis.
Example configuration
<pattern-list platforms>
    mail-from /@bounce\.platform-a\.com$/ virtual-mta=vmta-a    mail-from /@bounce\.platform-b\.com$/ virtual-mta=vmta-b
</pattern-list>
<source 0/0>
    pattern-list platforms
</source>
Rules are checked in order, and the first match wins; dots in the domain are escaped.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
How to check on the node
Check where the platform’s messages go:
pmta show queues '*/vmta-a'
Queues with the platform’s address after its campaign — the rule worked; messages in the default address’s queue — the return address did not match.