Knowledge base
postmasterGlobalcriticalDirectiveOne of the two settings the engine does not work without: the watchdog sends crash and license expiration reports here, and mail to service addresses is forwarded here as well.smtp-listenerGlobalcriticalset by the HubDirectiveIf no listener is declared, the node silently brings one up on 0.0.0.0:25.check-spf-inbound<source>DirectiveEnables the check on the way in and adds a header with its result to the message.deliver-unmatched-email<feedback-loop-processor>set by the HubDirectiveWhat to do with a message the processor did not recognize; delivers by default, and it is also the condition for forwarding.deliver-unmatched-email<bounce-processor>set by the HubDirectiveWhat to do with a message the processor did not recognize; delivers by default, and it is also the condition for forwarding.forward-unmatched-to<feedback-loop-processor>DirectiveThe address an unrecognized message goes to; the line is repeatable and requires delivery of unrecognized mail to be allowed.forward-unmatched-to<bounce-processor>DirectiveThe address an unrecognized message goes to; the line is repeatable and requires delivery of unrecognized mail to be allowed.reject-spf-check-fail<source>DirectiveThe most unambiguous of the three outcomes: the domain owner said that mail must not be sent from this address.reject-spf-check-permerror<source>DirectiveThe sender forbade nothing — it made a syntax mistake; the default rejects anyway.reject-spf-check-temperror<source>DirectiveThe only one of the three outcomes where the refusal is temporary: the sender is invited to retry.verp-default<source>DirectiveEnabling on the submission side: it applies to everything submitted through this source.address<address-list>set by the HubDirectiveAccepts three forms — a full address, a bare local part or a regular expression in slashes.aliasGlobalDirectiveDeclares an address whose mail goes to one or more other addresses; the short form applies to all local names of the node.body-pattern-file<email-patterns>DirectiveA regular expression with named groups that pulls accounting fields out of the body of a non-standard report; the line is repeatable.check-arc-inbound<source>DirectiveThe same observational check as for the regular signature; it has no refusals either.check-dkim-inbound<source>DirectiveObservation only: the engine has no refusals based on the signature check result at all.check-iprev-inbound<source>DirectiveA reverse address check: the PTR record is compared with the name the submitter introduced itself with.check-spf-inbound-max-void-lookups<source>DirectiveThe threshold protects the resolver from being spun up by someone else’s record — and turns complex records into a permanent error.deliver-matched-email<bounce-processor>set by the HubDirectiveWhat to do with a recognized message after parsing: deliver it to the recipient or discard it; discard by default.deliver-matched-email<feedback-loop-processor>set by the HubDirectiveWhat to do with a recognized message after parsing: deliver it to the recipient or discard it; discard by default.domain<address-list>DirectiveOne line instead of listing addresses — all recipients of this domain get on the list.forward-errors-to<feedback-loop-processor>DirectiveAn address for messages the processor could not parse; the line is repeatable.forward-errors-to<bounce-processor>DirectiveAn address for messages the processor could not parse; the line is repeatable.reject-iprev-check-fail<source>DirectiveThe default is to let it through, the opposite of the same-named line in the SPF family.reject-iprev-check-permerror<source>DirectiveA permanent reverse check error is almost always someone else’s unfilled zone, not a forgery.reject-iprev-check-temperror<source>DirectiveA temporary name resolution failure; the rejection here is temporary too, and usually your own resolver is to blame.relay-addressGlobalset by the HubDirectiveThe address counterpart of accepting by domain: it accepts a specific address or a regular expression, not a whole domain; the line is repeated.relay-domainGlobalDirectiveLists domains for which the node accepts mail regardless of who submits it; the line is repeated, and it is needed only where the node handles inbound mail.custom-dsn-from-headerGlobalDirectiveSets the report sender as a string without substitutions; a newer line with the same purpose can substitute values from the original message.dsn-failed-body-template-fromGlobalDirectiveThe path to the report body template file; nine values from the original message are substituted in it — from the node name to the receiver’s reply.dsn-failed-from-templateGlobalDirectiveSets the sender of the generated report with substitutions from the original message; an older line with the same purpose does not support substitutions.dsn-failed-subject-templateGlobalDirectiveSets the subject of the generated report with substitutions from the original message; the set of substitutions is shared with the body template.dsn-format<domain>DirectiveThe second value returns one part instead of the full report — the delivery status, as plain text — so that the report gets through mail filters that cut attachments.dsn-return-default<source>DirectiveThe default for the RET parameter, with which the sender asks to return the whole message or only the headers in the report; the plain-text format cancels this line.notify-of-delay-every<domain>DirectiveThe check interval for delay notifications the submitting side requested at submission; the value never turns them off for this receiver.trace-dkim-check<source>DirectiveA trace of signature verification: queries for the public key travel with the message.trace-iprev-check<source>DirectiveThe trace travels with the message; for the reverse check it is short, but its nature is the same.trace-spf-check<source>DirectiveA debugging switch: everything the node asked DNS goes into the message.deliver-email<feedback-loop-processor>deprecatedDirectiveOne line decided the fate of both recognized and unrecognized messages; replaced by two separate ones.deliver-email<bounce-processor>deprecatedDirectiveOne line decided the fate of both recognized and unrecognized messages; replaced by two separate ones.deliver-local-dsn<domain>deprecatedDirectiveDeprecated directive: it turned off report messages by sender domain; replaced by a setting in the source block.Who is allowed to submit mail and for whom to accept itcriticalMechanismOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.Address lists — named and unnamedMechanismA list of addresses, domains, patterns or hashes; a named one is attached by directives such as suppression, an unnamed one lives inside an inbound mail processor.Two inbound report processors and what to do with themMechanismBounces by message and complaints are parsed by two identically structured blocks; each has its own address list and its own pair of decisions about the message’s fate.Hand a message to a webhook instead of a receiverMechanismThe queue sends the message as a POST request in the form of a JSON object; only a 2xx response counts as success.What to do with an accepted messageMechanismWhat the node does with an accepted inbound message: forwards it, writes it to a file, discards it, passes it to a program or parses it as a bounce or complaint.Who took the portMechanismTwo listeners do not fit on one port: if the port is already taken, the node will not come up, and the cause will be only in the log.Replacing a recipient with one or several othersMechanismA message that arrives at a declared address is forwarded to others; expansion happens after the stream is chosen but before the message is queued into it.Handing a message to a program on the same nodeMechanismThe queue starts a program for each recipient and feeds the message to its input.Troubleshooting mail receptionProcedureThe troubleshooting procedure when messages are not accepted: enable connection and command logging for the source, look at the session, turn it back off.<bounce-processor>Configuration blockThe block enables parsing inbound messages for bounces; it catches them by a nested address list and writes accounting records of type rb.<feedback-loop-processor>Configuration blockThe block enables parsing inbound messages for complaints; it catches them by a nested address list and writes accounting records of type f.