Knowledge base
always-allow-relayingGlobalcriticalset by the HubDirectiveThe very reason a node sends mail at all — and the thing that makes it an open relay if granted to the wrong source.domain-keyGlobalcriticalDirectiveLinks a selector, a domain and a private key; the first entry whose domain matches or is a parent domain wins.host-nameGlobalcriticalDirectiveThe first name is the main one; which one ends up in the greeting is decided by a five-step resolution.http-accessGlobalcriticalset by the HubDirectiveA list of addresses and access levels for the management interface; closed to everyone by default.http-api-keyGlobalcriticalset by the HubDirectiveA key in the X-API-Key header grants administrator rights from any address; the line is repeatable.postmasterGlobalcriticalDirectiveOne of the two settings the engine does not work without: the watchdog sends crash and license expiration reports here, and mail to service addresses is forwarded here as well.run-as-rootGlobalcriticalDirectiveMust be false to run as an unprivileged user; changing it requires a restart.smtp-listenerGlobalcriticalset by the HubDirectiveIf no listener is declared, the node silently brings one up on 0.0.0.0:25.smtp-proxy-source-hostGlobalcriticalDirectiveThe vendor’s way to send through a proxy — local address, proxy, client address and greeting name in one line.smtp-source-hostGlobalcriticalDirectiveBinds outgoing connections to a local address or CIDR range and sets the name in the SMTP greeting.total-max-smtp-outGlobalcriticalset by the HubDirectiveKicks in first if a queue limit is higher; on a Standard license — silently.auto-mx-rollupGlobalDirectiveOne line instead of a list: the node groups the domains itself and makes up the queue name itself.enable-signalsGlobalDirectiveThe scope of export with three inheritance levels; the subaccount, the tracking domain or the rule list name are appended here too.http-csrf-protectionGlobalDirectiveForbids changing the node’s state with a GET request and requires a key or a session token on POST; enabled by default.http-enable-api-configGlobalDirectiveOpens an interface that allows creating address lists and sending addresses over HTTP; off by default.http-mgmt-portGlobalset by the HubDirectiveThe TCP port of the management interface; the value 0 does not bring up the monitor at all. The default is 8080.includeGlobalset by the HubDirectiveReads an additional file — by path, by mask or by HTTP address; the contents are processed as if written in this place.invalid-virtual-mta-fallbackGlobalDirectiveInstead of a refusal, the message leaves through the stream named here; it works only at submission and only if the refusal is turned off in the source.log-fileGlobalset by the HubDirectiveThe path to the log file; the line is mandatory, and it also sets the location of the monitor and SNMP logs.max-memory-usage-percentGlobalDirectiveWhen the share of physical memory is exceeded, the node responds 452 to MAIL FROM until usage drops back below it.name-serverGlobalDirectiveSets name server addresses; the line is repeated, and the engine goes through them in rotation. If not set, the operating system’s resolvers are used.openssl-security-levelGlobalDirectiveA number from 0 to 5 below which OpenSSL refuses to work with keys, certificates and protocol versions; 1 by default.proxy-include-tlvGlobalDirectiveAdds a field with the queue domain to the PROXY header; requires the second protocol version.smtp-server-tls-certificateGlobalset by the HubDirectiveAn X.509 certificate in PEM format — from a file or from a secrets store; the private key password is optional and can also be in the store.spool-max-recipientsGlobalDirectiveLimits how many recipients the node holds in queues; above the ceiling, submission is refused with a temporary error. The default is to calculate from the machine’s resources.track-time-first-attemptGlobalset by the HubDirectiveEnables tracking the time of the first attempt; it opens a field in accounting records and a delay metric. Off by default.use-proxyGlobalDirectiveA list of proxy blocks in backup order; the second is used only when the first did not respond.aliasGlobalDirectiveDeclares an address whose mail goes to one or more other addresses; the short form applies to all local names of the node.domain-macroGlobalset by the HubDirectiveDeclares a variable with a list of domains; after that its name with a dollar sign is substituted where the domains would otherwise have to be listed again.edns-udp-lengthGlobalDirectiveEnables the EDNS extension and sets the maximum UDP response size; without it responses longer than 512 bytes are truncated, and the route may be assembled incompletely.enable-inline-seedingGlobalDirectiveEnables seeding at the node, pool or sending address level; the default depends on whether the seeding block is declared, and the value true without a subaccount does not inherit it.host-idGlobalset by the HubDirectiveA per-server unique number that keeps two engine installations from producing the same Message-Id; the default of zero is the same for everyone.http-redirect-to-httpsGlobalset by the HubDirectiveWith true the monitor accepts only https and redirects plain connections; the default is true since version 5.0.http-tls-min-versionGlobalDirectiveThe oldest protocol version the node’s management interface will negotiate; TLS 1.2 by default.include-headers-fromGlobalDirectiveNames a file with headers in RFC 2822 format; they are inserted right after the Received header the node adds.ip-connection-limitGlobalDirectiveThe same as the limit by MX name, but selection goes by addresses in CIDR notation; allowed only at the node level.log-auto-rotationGlobalDirectiveThe switch for daily log file rotation; on by default.log-file-world-readableGlobalDirectiveGives all users on the node the right to read the engine’s logs; no by default.log-rotateGlobalDirectiveThe number of files, including the current one; the default is eight, and zero turns rotation off entirely.mx-connection-limitGlobalDirectiveLimits connections to each MX matching a pattern — but for each sending address separately, not in total. The vendor advises MX rollup instead.pickupGlobalDirectiveSets a pair of paths: where to read submitted files from and where to put the ones that could not be processed. Only one directory is supported.proxy-protocolGlobalDirectiveThe HAProxy header version, 1 or 2; the default is the first.relay-addressGlobalset by the HubDirectiveThe address counterpart of accepting by domain: it accepts a specific address or a regular expression, not a whole domain; the line is repeated.relay-debugGlobalDirectiveSwitches relay control into debug mode: instead of a final refusal the node responds with a temporary one, and the message stays with the sender instead of bouncing.relay-domainGlobalDirectiveLists domains for which the node accepts mail regardless of who submits it; the line is repeated, and it is needed only where the node handles inbound mail.smtp-await-slotGlobalDirectiveWhen there are no free inbound connection slots, the node either waits for one to free up or answers with a 421 greeting and closes the connection.smtp-server-tls-min-versionGlobalDirectiveThe oldest protocol version the node is willing to accept from a submitting client; the default is TLS 1.2, stricter than for sending.total-max-smtp-inGlobalset by the HubDirectiveLimits the number of simultaneous inbound SMTP connections for the whole node.track-inbound-perf-statsGlobalDirectiveEnables counting the time from MAIL FROM to the end of DATA on acceptance; useful only together with the metrics listener.track-outbound-perf-statsGlobalDirectiveEnables counting the time from MAIL FROM to the end of DATA when sending; useful only together with the metrics listener.volume-audit-api-keyGlobalDirectiveMandatory under a license that counts volume: with this key the node authenticates itself when sending data to the vendor. It is issued together with such a license.custom-dsn-from-headerGlobalDirectiveSets the report sender as a string without substitutions; a newer line with the same purpose can substitute values from the original message.domain-suffixGlobalDirectiveThe suffix appended to a single-part domain when completing addresses; it works only together with completion itself.dsn-failed-body-template-fromGlobalDirectiveThe path to the report body template file; nine values from the original message are substituted in it — from the node name to the receiver’s reply.dsn-failed-from-templateGlobalDirectiveSets the sender of the generated report with substitutions from the original message; an older line with the same purpose does not support substitutions.dsn-failed-subject-templateGlobalDirectiveSets the subject of the generated report with substitutions from the original message; the set of substitutions is shared with the body template.dummy-smtp-await-slotGlobalDirectiveWait for a slot or reply 421 at once — and 421 changes the behavior of the sending side.dummy-smtp-has-chunkingGlobalDirectiveThe default is not to announce it, and then the run uses a different transfer method than production mail will.dummy-smtp-has-pipeliningGlobalDirectiveOf the three lines in the set, this one affects the figure the most: without pipelining the conversation is several times longer.dummy-smtp-has-verpGlobalDirectiveNeeded exactly when mail with unique return addresses is run.dummy-smtp-ipGlobalDirectiveA local address keeps the black hole inside the machine; an external one opens it to the network.dummy-smtp-latencyGlobalDirectiveZero by default — and with zero the run measures the wrong thing: a real receiver never answers instantly.dummy-smtp-portGlobalDirectiveThe default of zero means “do not listen”: until the port is set, there is no mechanism.dummy-smtp-update-statsGlobalDirectiveOn by default — and it is the only line in the family that spoils production data.mailmerge-expands-undefined-variablesGlobalDirectiveWith the default an undefined variable turns into nothing; with the value false it stays in the message as is, brackets included.smtp-server-tls-ca-fileGlobalDirectiveA file with root certificates against which certificates presented by clients on incoming connections are verified.smtp-server-tls-cipher-server-preferenceGlobalDirectiveWith this line the cipher is chosen by the order in our configuration, not by the client’s order; the default is by the client.smtp-server-tls-ciphersGlobalDirectiveThe list of allowed ciphers in OpenSSL notation for incoming connections; applies to versions up to TLS 1.2, 1.3 has its own list.smtp-server-tls-max-versionGlobalDirectiveThe newest protocol version the node is willing to accept from a submitting client; unlimited by default.spool-delete-corruptedGlobalDirectiveMessage files with encoding errors — traces of data corruption on disk — are deleted instead of lying around idle.thread-reuseGlobalDirectiveTurning it off makes the engine discard threads immediately; this costs performance and removes a workaround for an old library bug. The default depends on the platform.time-first-attempt-hires-timestampGlobalDirectiveAdds milliseconds to the first attempt timestamp in accounting records; works only with counting enabled.total-max-transmissions-apiGlobalDirectiveHow many submitting HTTP connections the node serves at once; the engine does not check an upper bound — the operating system sets it.http-default-max-itemsGlobalDirectiveLength of the “Top Queues”, “Top Domains”, “Top VirtualMTAs” and “Top Jobs” lists; default 10.http-default-sort-orderGlobalDirectiveOrder of lines in the “Top” lists — by recipient count, by name or by volume; by recipients by default.http-log-dataGlobalDirectiveMore detailed logging than the request log; off by default.http-log-requestsGlobalDirectiveA switch for logging calls to the management interface; off by default.http-log-tlsGlobalDirectiveA switch for detailed logging of encryption negotiation in the monitor log; off by default.http-mgmt-sourceGlobaldeprecatedDirectiveReplaced by the http-access directive, which does the same and also distinguishes access levels.http-strict-transport-security-max-ageGlobalDirectiveThe max-age value in the Strict-Transport-Security header of monitor responses; default 0 — that is, do not remember.http-tls-allow-sslv3GlobaldeprecatedDirectivePowerMTA no longer supports SSLv3; the line is kept only for configuration compatibility.http-tls-allow-tlsv1GlobaldeprecatedDirectiveA separate switch for one protocol version on the management interface; deprecated in PowerMTA 5.5 in favor of a pair of bounds.http-tls-allow-tlsv1.1GlobaldeprecatedDirectiveA separate switch for one protocol version on the management interface; deprecated in PowerMTA 5.5 in favor of a pair of bounds.http-tls-allow-tlsv1.2GlobaldeprecatedDirectiveA separate switch for one protocol version on the management interface; deprecated in PowerMTA 5.5 in favor of a pair of bounds.http-tls-allow-tlsv1.3GlobaldeprecatedDirectiveA separate switch for one protocol version on the management interface; deprecated in PowerMTA 5.5 in favor of a pair of bounds.http-tls-ca-fileGlobalDirectivePath to a PEM file with authority certificates by which the monitor verifies the certificate of an incoming client.http-tls-cipher-server-preferenceGlobalDirectiveA switch: take the cipher by the order of the node’s list rather than by the client’s preference; off by default.http-tls-ciphersGlobalDirectiveA list of allowed ciphers in OpenSSL notation for the management interface; applies up to and including TLS 1.2.http-tls-max-versionGlobalDirectiveThe newest protocol version the management interface will negotiate; unlimited by default.http-tls-request-client-certificateGlobalDirectiveA switch for requesting a client certificate in the handshake; on by default.http-tls-v1.3-ciphersuitesGlobalDirectiveA colon-separated list of TLS 1.3 suites for the management interface; all five by default.log-hires-timestampGlobalDirectiveAdds milliseconds to log timestamps; off by default.no-http-mgmt-sourceGlobaldeprecatedDirectiveThe negative half of the former pair; replaced by an http-access line with the none level.pickup-remove-dotGlobalDirectiveA concession to programs that escape a dot by SMTP rules where it is not required — in pickup directory files.pickup-retry-intervalGlobaldeprecatedDirectiveThe directive is marked deprecated in the manual and not described: no purpose, no syntax, no default.pmc-acct-min-free-spaceGlobalDirectiveBelow the threshold the engine starts deleting the oldest accounting files accumulated for the management console; deleted data is lost forever.smtp-ipGlobaldeprecatedDirectiveThe replacement is smtp-listener: address and port in one line, and its presence silences this line.smtp-portGlobaldeprecatedDirectiveThe other half of a replaced pair: the port was set separately from the address, now they are written in one line.smtp-server-tls-allow-sslv3GlobaldeprecatedDirectivePowerMTA no longer supports SSLv3; the line is kept only for configuration compatibility.smtp-server-tls-allow-tlsv1GlobaldeprecatedDirectiveA separate switch for one protocol version for receiving; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-server-tls-allow-tlsv1.1GlobaldeprecatedDirectiveA separate switch for one protocol version for receiving; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-server-tls-allow-tlsv1.2GlobaldeprecatedDirectiveA separate switch for one protocol version for receiving; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-server-tls-allow-tlsv1.3GlobaldeprecatedDirectiveA separate switch for one protocol version for receiving; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-server-tls-v1.3-ciphersuitesGlobalDirectiveA separate list for version 1.3 on incoming connections; the default lists five modern suites.spoolGlobaldeprecatedDirectiveIt set the spool location with one line; replaced by a block that has priority, a free space threshold and modes.spool-min-free-spaceGlobaldeprecatedDirectiveIt set the threshold for all spool directories at once; replaced by the line of the same name inside the directory block.thread-max-priorityGlobalDirectiveSets the fast end of the priority range the engine’s threads run with; a Unix-only directive, paired with the lowest one.thread-min-priorityGlobalDirectiveSets the slow end of the priority range the engine’s threads run with; a Unix-only directive, paired with the highest one.