Knowledge base
bounce-after<domain>criticalset by the HubDirectiveUntil this point the message lives in the queue and takes up disk space.disable-acct-records<domain>criticalDirectiveDisables the creation of accounting records of the chosen types — delivery, bounce, transient failure, queuing failure — for an individual queue.dkim-sign<domain>criticalset by the HubDirectiveTurns signing on for the receiver; the key itself is chosen by the sending domain from the message headers.enable-source-ip-limits-on-sending-ip<domain>criticalDirectiveImportant when sending through a proxy: the local address and the one the receiver sees are different.max-msg-rate<domain>criticalset by the HubDirectiveIt counts both deliveries and bounces — this is not “successful messages per hour.”max-smtp-out<domain>criticalset by the HubDirectiveThe main lever of pressure on the receiver: it sees the limit multiplied by the number of your addresses.retry-after<domain>criticalset by the HubDirectiveIt can be set as a sequence: 10m, 1h, 4h — and then the pauses grow from attempt to attempt.backoff-max-msg-rate<domain>set by the HubDirectiveThe rate in backoff mode; without an explicit value the normal one is used — that is, the mode will slow nothing down.backoff-max-smtp-out<domain>set by the HubDirectiveThe only one in the family with its own default — 20, not “same as in normal mode.”backoff-notify<domain>set by the HubDirectiveA message arrives for both events — entering backoff mode and leaving it.backoff-reroute-to-virtual-mta<domain>set by the HubDirectiveThe only one in the family that does not slow down but moves: messages leave from another address while the queue is in backoff mode.backoff-retry-after<domain>set by the HubDirectiveThe retry schedule for the duration of backoff; set as a sequence.backoff-to-normal-after<domain>set by the HubDirectiveAfter what interval the queue returns to normal mode by itselfbackoff-to-normal-after-delivery<domain>set by the HubDirectiveWhether one successful delivery returns the queue to normal modebackoff-upon-all-sources-disabled<domain>DirectiveThe vendor warns directly: the queue will not come back by itself — a return timer is needed.bounce-category-patterns<domain>DirectivePuts your own reply parsing ahead of the general one — without changing whether the message bounced.bounce-upon-5xx-greeting<domain>set by the HubDirectiveThe vendor default is yes, and one misconfigured server in the MX list is enough to burn the queue.bounce-upon-no-mx<domain>set by the HubDirectiveIt accepts more than yes and no: an interval gives the domain time during which the node can try the address directly.check-spf-outbound<domain>DirectiveIf it fails, the message is bounced on our side before it reaches the receiving server; a temporary error means a retry.disabled-source-ip-notify<domain>DirectiveThe only thing that makes a quiet mechanism noticeable: a message arrives both on disabling and on re-enabling.discard-as-bounce<domain>DirectiveA discard queue still writes to accounting — this line decides with which letter.dkim-identity<domain>DirectiveLets you sign with your own key messages whose From has someone else’s domain — sending on behalf of a client.enable-tq-record-for-proxy-failure<domain>DirectiveRecords proxy connection failures in tq accounting records; off by default and ignored without this record type.max-cold-virtual-mta-msg<domain>DirectiveWarm-up built into the engine: part of the traffic is diverted to a new address while it builds reputation.max-connect-rate<domain>set by the HubDirectiveHow fast to open new connections to this recipient domainproxy-retry-after<domain>DirectiveThe same retry step, but for the case when the connection through the proxy did not reach the receiver.queue-to<domain>DirectiveWritten in the block of each domain in the group: you set the shared queue name, the node does not derive it.reenable-source-ip-after<domain>DirectiveThe default is never: an address disabled without an explicit deadline will never come back.require-starttls<domain>set by the HubDirectiveWith this line the node drops the connection instead of sending in plain text; the default is to send.reroute-to-virtual-mta<domain>DirectiveThe queue stays the same; what changes is the second half of its name — the address messages leave from.retry-recipients-after<domain>set by the HubDirectiveA lower bound on the pause for an address that got a 4xx response — on top of the queue’s common schedule.smtp-553-means-invalid-mailbox<domain>set by the HubDirectiveA guess in place of what the receiver left unsaid — and whether the address ends up on the blocklist depends on it.smtp-hosts<domain>DirectiveA list of hosts with preference levels, ports and addresses — or an instruction to take another domain’s MX.smtp-pattern-list<domain>set by the HubDirectiveAttaches a named pattern list to connections with the recipient domain; it is used to parse its SMTP responses and assign actions.smtp-tls-min-version<domain>DirectiveThe oldest protocol version the node is willing to negotiate when sending; the default is TLS 1.1.source-ip-max-connect-rate<domain>DirectiveNot how many connections to hold, but how often to open them — for each address separately.source-ip-max-msg-rate<domain>DirectiveThe main one in the family: the manual directly names it for those who have several IPs in one sending address.source-ip-max-smtp-out<domain>DirectiveSplits the queue limit by address: each address matching the mask gets a number of its own.use-dane<domain>DirectiveThe node reads the recipient domain’s DANE records, requires encryption if the domain requires it, and checks the certificate against the fingerprint from DNS; the default is off.use-mta-sts<domain>set by the HubDirectiveThe node fetches the recipient domain’s policy and, if it is in enforce mode, delivers only when the MX matches, the connection is encrypted and the certificate is verified; the default is off.use-starttls<domain>set by the HubDirectiveEnables STARTTLS if the receiver offers it; the default is on.allow-cancel-during-transfer<domain>DirectiveThe default allows it — for a fast service shutdown; turning it off protects against duplicates but makes the node stop more slowly.arc-identity<domain>DirectiveUnlike the regular signature, the name goes into the domain field — the very one the recipient uses to look up the key.arc-sign<domain>DirectiveEnables three ARC headers; the keys are the same as for the regular signature.assume-delivery-upon-data-termination-timeout<domain>set by the HubDirectiveA bet that the message got through: there will be no duplicates, but no truth in accounting either.auth-password<domain>DirectiveThe second half of the pair; the hash sign is not allowed in it — the engine treats it as the start of a comment.auth-username<domain>DirectiveOne of the two lines that enable outgoing authentication: either of them being non-empty is enough.backoff-max-connect-rate<domain>DirectiveThe default is tricky: without an explicit value the regular connection rate is taken — that is, backoff does not slow connections down.backoff-max-data-volume-rate<domain>DirectiveThe same default trap: without an explicit value the regular volume limit is taken.bounce-upon-transfer-failure<domain>DirectiveA choice between the risk of a duplicate at the recipient and the risk of not delivering the message at all.command<domain>DirectiveMandatory for a pipe queue; substitutions with message properties are expanded in the line.connect-timeout<domain>DirectiveThe first timeout of the conversation: things have not yet reached the greeting.connection-idle-timeout<domain>set by the HubDirectiveThe maximum is ten minutes: that is how long the engine is willing to keep a connection waiting for the next message.disable-mx-rollup<domain>DirectiveTurns off both kinds of combining for the domain at once — both the manual list and the automatic one.dkim-add-body-limit<domain>DirectivePuts the length of the signed part into the signature: an appended footer no longer breaks it — and is no longer noticeable.dkim-disallow-adding-headers<domain>DirectiveThe reverse task: the listed names are put into the signature one extra time, and the appearance of such a header breaks it.dkim-headers<domain>DirectiveThe mandatory list cannot be changed — this line only adds your own to it.dkim-identity-fallback<domain>DirectiveNo key matched the sender’s domain — we sign with our own instead of sending without a signature.file-destination<domain>DirectiveA path with substitutions: the date, domain and recipient can be inserted right into the name.file-format<domain>DirectiveA file per message, a file per message with envelope addresses, or a shared mbox mailbox.http-delivery-url<domain>DirectiveMandatory for an http-delivery queue; an absolute address without credentials or a query string.include<domain>DirectiveThe same directive written inside a recipient block — the included lines become that recipient’s rules.log-disabled-ips<domain>DirectiveThe only source of history: the list of disabled addresses shows “now,” the log shows “what happened.”max-data-volume-rate<domain>set by the HubDirectiveHow many bytes per interval, counting only successful deliveriesmax-errors-per-connection<domain>set by the HubDirectiveThe default is no limit: the connection lives on, however many recipient refusals pile up on it.max-events-recorded<domain>DirectiveNot a log but memory: the last ten errors for a domain, visible in the console and the web monitor.max-msg-per-connection<domain>set by the HubDirectiveThe default is zero, no limit: it pays for the engine to send as much as possible over one connection.max-rcpt-per-transaction<domain>DirectiveCuts a message with a large list into several transfers: more parallelism, but the body goes to the receiver as many times as there are pieces.queue-priority<domain>DirectiveWhen there are no free connections, the engine interrupts the connections of lower-priority queues — starting with the lowest.retry-after-dns-error<domain>set by the HubDirectiveA separate, shorter step: the receiver never saw this attempt, and haste does not threaten it in any way.retry-upon-new-mail<domain>DirectiveBypasses the retry schedule: every new message in the queue schedules an attempt immediately.smtp-421-means-mx-unavailable<domain>set by the HubDirectiveThe vendor default is to stay on the same connection; enabling it moves the queue to the receiver’s backup server.smtp-client-certificate<domain>DirectiveThe client certificate the node shows the receiver on an outgoing connection; its password is set as the second word and is optional.smtp-data-termination-timeout<domain>DirectiveThe last wait of the conversation — and the most dangerous one: shorten it and you get duplicates.smtp-out-rampup-interval<domain>set by the HubDirectiveA soft start: connections are opened one at a time with a pause, not in a burst.smtp-tls-ca-file<domain>DirectiveA file with root certificates against which the chain presented by the receiver is verified; by default the list from the distribution is used.source-ip-max-data-volume-rate<domain>DirectiveThe only one in the family that counts what was delivered rather than attempts; without a suffix the number reads as bytes.track-recipient-events<domain>DirectiveOff by default: the queue page says nothing about what happened to specific addresses.type<domain>DirectiveOne line that switches the queue between five delivery methods.use-unencrypted-plain-auth<domain>DirectiveBoth mechanisms transmit the password in the conversation; without encryption it goes over the network in the clear.verp-default<domain>DirectiveThe same enabling, but targeted: only for messages to this domain.allow-priority-interruption<domain>DirectiveWith the value no the queue becomes untouchable: its connections are not taken away, however high the neighbor’s priority.allow-priority-interruption-during-transfer<domain>DirectiveWith no the interruption is postponed until the connection frees up; with yes it happens immediately, in the middle of a transfer. Only for SMTP queues.bcc-upon-delivery<domain>DirectiveThe blind copy is taken on the recipient side and only from delivered messages; an empty string erases the inherited value.bounce-upon-pix-transfer-failure<domain>DirectiveA narrow case of the general line: it fires if the receiver’s greeting contains at least ten asterisks.data-send-timeout<domain>DirectiveThe third wait of the conversation; the manual reminds: less than three minutes violates the mail standard.default-smtp-port<domain>DirectiveUsually 25; a change is needed where sending addresses are told apart by destination port.dsn-format<domain>DirectiveThe second value returns one part instead of the full report — the delivery status, as plain text — so that the report gets through mail filters that cut attachments.http-delivery-extra-headers<domain>DirectiveThe only place to put authorization: credentials in the address itself are forbidden.ignore-8bitmime<domain>DirectiveA workaround for a known incompatibility: the external gateway accepts 8BITMIME, while the internal one behind it does not.ignore-chunking<domain>DirectiveA debugging switch: returns the transfer to the ordinary DATA command.ignore-dsn<domain>DirectiveCancels the delivery report requests the message carries from submission.ignore-pipelining<domain>DirectiveThe second debugging switch: commands go one at a time, with a reply to each.log-resolution<domain>DirectiveWrites to the log the course of name and route lookup for the receiver; off by default.log-transfer-failures<domain>set by the HubDirectiveWrites a warning when the connection breaks while headers and body are being transferred; off by default.macro-variables-preserve-case<domain>DirectiveApplies only to $to and $from: the recipient’s user name and domain are always lowercased.max-rcpt-per-message<domain>DirectiveThe same splitting limit under another name — and a full namesake of the reception setting from the submission block.notify-of-delay-every<domain>DirectiveThe check interval for delay notifications the submitting side requested at submission; the value never turns them off for this receiver.pix-bug-workaround<domain>DirectiveOn by default: a workaround for a known fault that causes messages to be duplicated.replace-smtp-421-service-response<domain>DirectiveReplaces the text after the 421 code with “service unavailable”, so that addresses from someone else’s reply do not get into the bounce report; pattern-based parsing keeps working.reuse-ssl-session<domain>set by the HubDirectiveSpeeds up a repeated handshake with the same host; does not work on TLS 1.3 and, according to the manual, is supported by only one known receiver.smtp-greeting-timeout<domain>DirectiveThe second wait of the conversation: there is a connection, the receiver is silent.track-jobs<domain>DirectiveEnables counting jobs per receiver and showing them on its page in the web monitor; off by default.add-x-msys-api-header<domain>DirectiveAdds the service header that sets SparkPost options and carries the job label into it as the campaign name; a header already in place is left untouched.add-x-msys-api-header-metadata<domain>DirectiveCarries the content of the named headers into the service header; does not work without the parent line, with the header already in place, or for headers the node adds itself.arc-algorithm<domain>DirectiveThere is exactly one value; the line exists for completeness of the set, not for choice.arc-body-canon<domain>DirectiveThe only ARC canonicalization line where there really is a choice.arc-expire-after<domain>DirectiveThe default is never; a forwarder’s window for reuse is especially large.arc-headers<domain>DirectiveThe mandatory set is the same as for the ordinary signature; the line only adds to it.arc-headers-canon<domain>DirectiveExactly one method is supported; unlike the ordinary signature, there is no choice.arc-identity-fallback<domain>DirectiveFor a forwarder this is not a fallback but the main path: it never has other people’s keys.arc-oversigned-headers<domain>DirectiveThe same protection against substitution as with the ordinary signature; there is no default, and without the line it does not act.backoff-max-msg-per-hour<domain>deprecatedDirectiveThe replacement is backoff-max-msg-rate, and it has a default this form did not have.deliver-local-dsn<domain>deprecatedDirectiveDeprecated directive: it turned off report messages by sender domain; replaced by a setting in the source block.delivery-priority<domain>deprecatedDirectiveThe section contains only the deprecation mark and a pointer to the replacement: queue priority.dkim-add-timestamp<domain>DirectiveOne field by which you can later tell when the message was signed.dkim-algorithm<domain>DirectiveThe default is right; the second value is obsolete and no longer accepted by receivers.dkim-body-canon<domain>Directiverelaxed forgives extra spaces in lines, simple does not; empty lines at the end of the body do not count under either.dkim-expire-after<domain>DirectiveThe default is never; an expiry is set where reuse of a signed message is feared.dkim-headers-canon<domain>Directiverelaxed forgives spaces and the case of names, simple forgives nothing.dkim-query-method<domain>DirectiveThere is exactly one lookup method, and it is implied by default; the line exists for compatibility.log-tls<domain>DirectiveDetails of encryption negotiation with the receiver in the node’s log; the default is not to log.max-msg-per-hour<domain>deprecatedDirectiveThe replacement is max-msg-rate: the same limit, but the interval is written in the value itself.max-smtp-out-per-source-ip<domain>deprecatedDirectiveThe former name of the per-address connection limit; the manual says nothing more about it.route<domain>deprecatedDirectiveThe same mechanism under an old name: the manual gives it word for word the same description and asks you to use the new one.smtp-tls-allow-sslv3<domain>deprecatedDirectivePowerMTA no longer supports SSLv3; the line is kept only for configuration compatibility.smtp-tls-allow-tlsv1<domain>deprecatedDirectiveA separate switch for one protocol version; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-tls-allow-tlsv1.1<domain>deprecatedDirectiveA separate switch for one protocol version; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-tls-allow-tlsv1.2<domain>deprecatedDirectiveA separate switch for one protocol version; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-tls-allow-tlsv1.3<domain>deprecatedDirectiveA separate switch for one protocol version; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-tls-ciphers<domain>DirectiveA list of allowed ciphers in OpenSSL notation; applies to versions up to TLS 1.2, there is a separate line for 1.3.smtp-tls-max-version<domain>DirectiveThe newest protocol version the node is willing to negotiate when sending; unlimited by default.smtp-tls-v1.3-ciphersuites<domain>DirectiveA separate list for version 1.3 — its suites are structured differently than those of previous versions.sparkpost-ip-pool<domain>DirectiveNames an address pool on the service’s side; the addresses themselves are not yours, and their reputation is shared with the service’s other customers.sparkpost-sandbox<domain>DirectivePasses the sandbox option to SparkPost: the message goes out from a SparkPost test domain without your own sending domain, and according to the SparkPost documentation an account gets no more than five such messages.