Knowledge base
Removing a sending address — and what happens to its queuecriticalProcedureThe definition is removed with an edit and a reload; messages still tied to the removed address bounce with their own code.Initial configurationcriticalProcedureThe manual requires two things to be set by hand: the responsible person’s address and relaying control — sources for submitting machines with always-allow-relaying; reception rules are needed only if the node accepts inbound mail.Installing on LinuxcriticalProcedureInstall the vendor’s package with the standard package manager, put the license key in place, check the configuration against the requirements and start the engine once — after that it comes up by itself.Prepare a machine for the enginecriticalProcedureFive requirements and a supported operating system must be in place before installation: a static address with a name, a reachable resolver, synchronized time, sized hardware and a license key.How to enable DKIM signing from scratchcriticalProcedureEight steps: domain, selector, key, permissions, DNS record, declaration, enabling and routing.Introducing a new address with part of someone else's trafficcriticalProcedureA warmed-up address hands its partner the first messages of the day to each receiver; the counters reset at midnight and survive a restart.Restrict who can reach the node at allProcedureFive steps of least privilege: the right to hand over mail only for logins, receiving only from a narrow range, the monitor likewise, and running without system administrator rights.Node backup and restoreProcedureFive directories make up the node’s recoverable state; restoring means stopping the engine, putting the directories back and starting it again.Change a sending address when messages are already queuedProcedureNew connections pick up the new definition right after the configuration reload; already open ones live out their lives on the old one.Lock down permissions on configuration filesProcedureThe configuration holds passwords, API keys and private signing keys — the manual gives specific commands for them, and included files require the same.Change a signing key without interrupting sendingProcedureAdd the new key under a new selector, apply, start signing with it, wait for messages with the old one to leave — and only then remove the old one.Running without root privilegesProcedureMoving the engine to run as a separate user: the line itself, ports above one thousand twenty-four, raised limits on files and processes, and changing the owner of five directories.Figure out why a queue to one receiver is growingProcedureFirst check the route and reachability with one command, then make the node attempt delivery with the session logged, and only for an intermittent problem enable per-receiver logging.Investigating a startup failureProcedureThe order of looking for the cause when the engine does not come up: the separate startup error file, the main log, a console run with output to the screen.Upgrading the engineProcedureBefore upgrading, make sure the license file holds a key valid for the new version and that the support term has not expired — and only then upgrade the package.Switching over to a standby nodeProcedureThe procedure for handing work to another machine: redirect submission, attach the failed node’s spool as a second one if possible, restart the standby, and do the reverse on return.What to do after a crashProcedureThe procedure after a crash: make sure the watchdog brought the engine back up, keep the report email, find the crash dump, pass it to the vendor.Starting and stopping the engineProcedureThe engine runs as a service on Windows and as a daemon on Unix; after start the watchdog must be running next to it, and a stop halts delivery without touching the messages on disk.Troubleshooting mail receptionProcedureThe troubleshooting procedure when messages are not accepted: enable connection and command logging for the source, look at the session, turn it back off.Removing the engineProcedureRemoving the package with the standard package manager. The node’s state stays on disk.Deployment in the cloudProcedureInstalling in the cloud adds a few conditions of its own to the ordinary installation: choosing the machine type by estimate, a fixed address and a lifted restriction on the outgoing mail port.Enabling FIPS modeProcedureSwitching the node to a validated set of cryptographic algorithms. Some familiar encryption settings become unavailable.Contacting the vendorProcedureWhat to collect and where to turn when you could not sort it out on your own.Installing on WindowsProcedureInstallation with a wizard, with the same license and configuration requirements as on Linux.