Knowledge base

PMTA knowledge base›Configuration block§ 3.3.7

<source>

critical

Who can submit mail and on what terms

Decided before the message gets into the queue

The block applies by the address the connection came from — and everything in it is decided before the message joins the queue.

What it decides. Whether relaying is allowed at all, which control headers the node honors, which limits apply to the message and recipients, whether authentication is required and how exactly.

Merging works as for receivers. Several blocks may match, and a narrower address range overrides a wider one (source-matching).

Header decisions live here too: which ones to strip before sending, whether to add its own Received, whether to obey the choice of sending address. That is, the block is the border between someone else’s mail and ours.

Example configuration

# the submission block the Hub writes
<source {pmta-auth}>
    require-auth true    always-allow-relaying yes
    default-virtual-mta pmta-pool
    pattern-list pmta-pattern
</source>

The highlighted line is what makes the block safe: relaying is allowed, but only to those who have logged in. The block name in curly braces is a reference to the submission account, not an address pattern.

yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.

Block directives: 74

Message content 16

jobid-prefixA prefix added to the job tag from the message process-x-jobset by the HubWhether to read the x-job header and tag the message with it add-date-headerWhether to add a Date header if there is none add-message-id-headerset by the HubWhether to add a Message-Id header if there is none add-received-headerset by the HubWhether to add a Received header when accepting a message add-x-virtual-mta-headerWhether to add a header with the stream name to the message if there is none allow-mailmergeWhether merge extensions can be used from this source bccThe address every message from this source is copied to jobid-headerWhich header to take the job label from instead of x-job pattern-listset by the HubWhich rule list applies to messages from this source remove-headerset by the HubWhich headers to cut from the message date-header-timeWhich time goes into the added Date header process-x-envidWhether to read the x-envid header and set the envelope identifier from it replace-message-id-headerWhether to replace the message identifier set by the sender retain-x-dkim-optionsWhether to keep the X-DKIM-Options header in the message on delivery retain-x-jobWhether to keep the x-job header in the message on delivery

Mail submission 14

accept-invalid-recipientsWhether to accept syntactically invalid addresses instead of refusing them in the session allow-authWhether the AUTH command is allowed for this source allow-smtputf8Whether international addresses can be submitted from this source always-allow-api-submissionWhether to enable all permissions needed for API submission at once disconnect-on-transient-errorWhether to close the connection instead of a temporary refusal max-message-sizeset by the HubThe largest message size accepted over SMTP from this source max-rcpt-per-messageHow many recipients are accepted per message source-groupWhich source group this source belongs to too-many-rcpts-fails-messageWhether exceeding the number of recipients fails the whole message allow-chunkingWhether the CHUNKING extension is offered to this source auto-qualify-domainset by the HubWhether to complete an incomplete address domain with the domain suffix max-message-hopsHow many Received headers a message may carry smtp-command-timeoutHow long to wait for a command in an incoming SMTP exchange smtp-data-timeoutHow long to wait for data in the message body transfer phase

Access 9

process-x-dkim-keycriticalWhether to read the private signing key from a message header retain-x-dkim-keycriticalWhether to keep the private signing key in the sent message smtp-servicecriticalset by the HubWhether to offer SMTP to connections from this source allow-unencrypted-plain-authset by the HubWhether to allow the PLAIN mechanism on an unencrypted connection allowed-sender-listsWhich lists the sender address is checked against at submission require-authset by the HubWhether to require login before accepting any mail from this source smtp-max-auth-failure-rateset by the HubHow many failed logins per period are allowed from this source hide-message-sourceWhether to hide the submitter’s name and address in the acceptance mark broken-auth-clientsdeprecatedObsolete, without a description and without a named replacement

Signing 8

check-spf-inboundWhether to check SPF for mail submitted to us reject-spf-check-failWhether to reject a message when the SPF check explicitly fails reject-spf-check-permerrorWhether to reject a message when the sender’s SPF record is unreadable reject-spf-check-temperrorWhether to reject a message when the check could not be performed check-arc-inboundWhether to verify the forwarding seal on messages submitted to us check-dkim-inboundWhether to verify the signature on messages submitted to us process-x-dkim-optionsWhether to read the X-DKIM-Options header and adjust the signature by it check-spf-inbound-best-guessdeprecatedDeprecated line: do not use

Diagnostics 7

log-commandsset by the HubWhether to record the whole SMTP conversation log-connectionsset by the HubWhether to record the start and end of every connection log-dataset by the HubWhether to record every byte of the exchange log-tlsWhether to log the course of TLS negotiation at submission trace-dkim-checkWhether to put signature verification queries into the message header trace-iprev-checkWhether to put reverse check queries into the message header trace-spf-checkWhether to put all queries made during verification into the message header

Sending addresses 5

default-virtual-mtacriticalset by the HubThe default stream or pool for messages from this source process-x-virtual-mtacriticalset by the HubWhether to read the X-Virtual-MTA header and select the stream by it reject-invalid-virtual-mtaWhether to reject a message that named a nonexistent or empty stream allow-empty-x-virtual-mtaWhether an empty X-Virtual-MTA header value is acceptable retain-x-virtual-mtaWhether to keep the processed X-Virtual-MTA header in the message

DNS 5

check-iprev-inboundWhether to check that the submitter’s address matches its name check-spf-inbound-max-void-lookupsHow many empty DNS answers to tolerate during an SPF check reject-iprev-check-failWhether to reject a message when the address does not match the name reject-iprev-check-permerrorWhether to reject a message when the reverse check cannot be performed reject-iprev-check-temperrorWhether to reject a message when the reverse check failed to run

TLS 3

allow-starttlsset by the HubWhether to let the client start encryption during submission require-starttls-before-authWhether to require encryption before the password is entered require-starttlsWhether to require encryption before any commands during submission

Bounces 3

verp-defaultWhether to put the recipient into the return address of all mail from this source suppress-local-dsnset by the HubWhether to generate outcome reports for mail from this source dsn-return-defaultWhether a bounce report returns the whole message body or only headers

Queue 2

process-x-scheduleWhether to read the x-schedule header and honor delivery windows retain-x-scheduleWhether to keep the x-schedule header in the message on delivery

Suppression 1

suppression-listsSuppression lists for messages from this source

Core 1

includeInclude a settings file inside a source block

Compatibility

PowerMTA 6.0

described in the manual of this version · platform: any

The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.

⇄

Related entries

0 relations

Referenced from

Restrict who can reach the node at allRestricting receiving is expressed with source blocks and address ranges. § 1.6.1 Who is allowed to submit mail and for whom to accept itThe permission is granted to a source block and obeys its merging. § 2.3 smtp-listenerGlobalThe configuration block where the mechanism lives. § 3.3.1.27 always-allow-relayingGlobalThe permission is granted to a source block and obeys its merging. § 3.3.1.54.1

◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇Headers the sender uses to control deliverySix control headers let the submitting side choose a stream, tag a message with a job, set signing options and the key, the envelope identifier and the schedule; each is allowed separately and per source.◇The load balancer header at the entranceThe node reads the PROXY header at the start of an incoming connection and treats the address from it as the source; this works for both kinds of entry point.

In the Hub

Cost of a mistake: reversible: harms only while it is set
Scenarios: Node security · Connect a sending platform
Priority: critical