Knowledge base
The daily warm-up quota in one submissionRecipeA day’s warm-up quota can be submitted as one merge: the sending address, job and parts as recipient variables, the time as delivery windows in the message itself.A new address without an external schedulerRecipeWarm-up with configuration tools: the new address’s share in the pool, the ceiling on its rate and the per-recipient rate — three scopes for one stage.A node that answers only its own fleetRecipeThe submission port serves only known platforms: the common source is closed with smtp-service, permissions are granted to submission addresses, and the MX listener needs its own source.A node that politely refuses instead of crashingRecipeOn a shared machine the node should refuse new mail with a temporary error before memory runs out: a memory threshold, a ceiling on queued recipients and a connection limit.A queue that responds to degradation by itselfRecipeFive backoff lines per recipient — rate, connections, retries, exit and notification — so that the queue slows down by itself as soon as the receiver starts refusing.A suppression list that cannot be readRecipeThe suppression list stores not addresses but their SHA-256 hashes, and accounting hides the local part of the address with its own keyed hash — these are two different halves, and they cannot be linked.Accounting as a contract with the consumerRecipeThe accounting stream is a contract with its consumer: record types, fields, time format, buffer flushing and the node marker are assigned explicitly rather than left at defaults.One question to one receiverRecipeOne question to a receiver without editing the configuration: rotate the log, run trace with logging to the log file, and fetch the file through the monitor.Deciding “hard or soft” where the reply arrivedRecipeA bounce category can be assigned on the node with your own names through bounce-category-patterns, so that the accounting record already carries the decision rather than text to be translated.Encrypt where the receiver requires itRecipeEncryption where the receiver itself requires it — through DANE and MTA-STS, and the blunt require-starttls only for recipients for whom plain text is unacceptable.An address of its own for a platform that does nothing for itRecipeA platform that does not set control headers gets its own sending address assigned on the node — by the return address, by the submission endpoint or by the connecting address.Reaction on the node sideRecipeA receiver reply caught by <smtp-pattern-list> switches the queue to backoff mode within the same connection — the Hub writes the rules, the node executes them.A return address that explains itselfRecipeA unique return address per message names the campaign and the recipient by itself: a report is identified by the address it arrived at, not by parsing text.A management entrance open only to your ownRecipeMonitor access for the Hub only: a narrow http-access, the http-api-key key, https and protection against forged requests.A node that really runs without root privilegesRecipeA node without root rights is three conditions at once: run-as-root false with a restart, listeners above port 1024 and node files owned by the pmta user.A rented address configured all the wayRecipeA rented address behind a proxy in block form: a <proxy> block with a gateway and a client, a number of attempts, fallback gateways in use-proxy and limits by client address.One transport, one login, one wayRecipeAll node management through the monitor with one key — read, write, check, reload — instead of SSH for files and HTTP for commands.A per-address rate that survives the proxyRecipePer-address limits when sending through a proxy must count the address the receiver sees: without enable-source-ip-limits-on-sending-ip they count the local one.Retiring an address without bouncing mailRecipeRemove a sending address from a node where mail still sits on it in order: stop submission, check the queues, and only then delete or redirect.Taking one address out for one receiverRecipeWithdraw one address for one receiver: confirm the guess with show domains, withdraw it with disable source with a return deadline, and reconcile show disabled sources on a schedule.Selecting the fields that answer questionsRecipeAccounting fields outside the default set — delivery encryption, retry count, proxy — are written only if named in record-fields, and they cannot be recovered for the past.Recording the conversation just for the time of troubleshootingRecipeRecording the conversation with one recipient or one source for the duration of diagnosis: log-connections and log-commands in a narrow block, log-data only when bytes are suspected.The monitor as a private control panelRecipeThe monitor can run commands and change the configuration, so access to it is decided like access to a shell: its own port, a narrow address list and a real certificate.Returned mail as a telemetry sourceRecipeThe MX listener turns bounces and complaints into accounting records: what is identified is absorbed, what is not is kept for analysis, and SPF authenticity checking also enables rejection.