Demo
Demo

Knowledge base

PMTA knowledge base›Recipe

A rented address configured all the way

One address through a proxy — and everything that comes with it

The task. The gateway’s unit of work: a rented address with an open port 25 that receivers see as a sending address with its own reputation.

What it is made of:

  • server — where PowerMTA connects: to the gateway, not to the provider’s endpoint;
  • client — the rented address the receiver will see, and the name for the greeting;
  • retry-attempts — how many times to try this proxy before moving to the next one in the list;
  • use-proxy — the list of proxy blocks for a sending address, in fallback order;
  • enable-source-ip-limits-on-sending-ip — limits by client address rather than by the local one.

The parts have different scopes. The <proxy> block is node-level and must be named, use-proxy is on a sending address or for the whole node, and the limits switch is per recipient, in <domain *>.

How they interact. The manual describes two proxy forms, and they are incompatible: the block form suits a few gateways serving many addresses, the line form — smtp-proxy-source-host — one line per address. The next proxy in use-proxy is taken only when the connection to the previous one failed, and if it has a different client, messages silently start going out from a different address.

The main trap is a fallback proxy with a different rented address. Switching over via use-proxy happens silently, and messages go out from an address with a different reputation and a different warm-up stage; the fallback must be a second gateway to the same address.
What the Hub does. It solves the same task with another form. The Hub’s gate is built not on <proxy> blocks and use-proxy but on the line form: each proxy has its own sending address with smtp-proxy-source-host pointing to the node’s gate, proxy-protocol 2 and proxy-include-tlv domain. None of the setup’s components is set: there are no source-ip-max-* limits, and the enable-source-ip-limits-on-sending-ip switch is not needed (removed on Sep 15, 2026); an address has no spare proxy, and retry-attempts is not set.
Recommended values

Block form lines:

Line Where Default What to set
server <proxy> required the gateway’s address and port
client <proxy> required the rented address and name
retry-attempts <proxy> 1, no more than 10 more than one
use-proxy sending address none the main gateway, then the fallback
enable-source-ip-limits-on-sending-ip <domain *> false true, then a restart
The block lines, the default and ceiling of attempts, the fallback order and the incompatibility of the two forms come from the manual (§ 3.3.22–3.3.22.5, § 3.3.1.47, § 3.3.10.86). The choice of form and the fallback advice are our hypothesis.
Example configuration
<proxy gw1>
    server 10.1.2.3:5000
    client 198.51.100.25 mail25.example.com
    retry-attempts 3
</proxy>
<virtual-mta rented25>
    use-proxy gw1, gw2</virtual-mta>
gw2 is a second block of the same kind with a different gateway and the same client; the addresses are for illustration.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
How to check on the node
Check that the proxy configuration parses:
pmta test config
grep -n -A4 '<proxy' /etc/pmta/config
Which proxy actually carried a message is shown by the dlvProxyName field in accounting, if it is named in record-fields.