Demo
Demo

Knowledge base

PMTA knowledge base›Configuration block§ 3.3.17

<smtp-listener>

The inbound SMTP listener
What is accepted on one port, and how

The smtp-listener line at the root of the file opens a port. A block with the same address describes how to handle connections on it — and everything written in it concerns only this port.

Three lines decide the port’s role. source binds it to a named source block, canceling the usual address-based matching — this is how submission and inbound mail receiving are separated onto different ports. await-slot decides whether to wait for a free slot when the inbound connection ceiling is reached, or to refuse. immediate-tls enables encryption from the first byte, without the STARTTLS command.

The rest is encryption: a tls-certificate of its own per port (inherited from the node’s common line), the choice of versions and cipher sets, client certificate verification. Plus three lines about the PROXY protocol, if a load balancer stands in front of the node.

Example configuration
# two ports with different roles: submission and inbound mail receiving
smtp-listener 0/0:2525
smtp-listener 0/0:25

<smtp-listener 0/0:25>
    source inbound-only
    await-slot true
</smtp-listener>
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Block directives: 18
TLS 13
tls-certificateThis listener’s certificateimmediate-tlsEncrypt the connection from the first byte — SMTPStls-min-versionThe lower bound of the TLS version on this entry pointtls-ca-fileTrusted authorities for this listener’s clientstls-cipher-server-preferenceWhose preference order rules on this inputtls-ciphersThis listener’s cipher set for versions up to TLS 1.2tls-max-versionThe upper bound of the TLS version on this inputtls-v1.3-ciphersuitesThis listener’s cipher suite set for TLS 1.3tls-allow-sslv3deprecatedWhether to accept SSLv3 on this input — the directive has no effecttls-allow-tlsv1deprecatedWhether to accept TLS 1.0 on this input — a deprecated switchtls-allow-tlsv1.1deprecatedWhether to accept TLS 1.1 on this input — a deprecated switchtls-allow-tlsv1.2deprecatedWhether to accept TLS 1.2 on this input — a deprecated switchtls-allow-tlsv1.3deprecatedWhether to accept TLS 1.3 on this input — a deprecated switch
Mail submission 2
sourceWhich named source applies to this listener’s connectionsawait-slotWhether new connections on this listener wait when the ceiling is exhausted
Proxies 2
use-inbound-proxyWhether to expect a load balancer header at the mail submission entry pointinbound-proxy-timeoutHow long to wait for the load balancer header at the mail submission entry
Diagnostics 1
log-inbound-proxyWhether to log the load balancer header at the mail listener input
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
◇

What else to read

3 articles

◇How a message gets into the engineSix described submission methods: extended SMTP, four language bindings and a directory the node watches on disk.◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇Headers the sender uses to control deliverySix control headers let the submitting side choose a stream, tag a message with a job, set signing options and the key, the envelope identifier and the schedule; each is allowed separately and per source.

In the Hub
Cost of a mistake
reversible: harms only while it is set
Scenarios
Connect a sending platform