Knowledge base
log-fileGlobalset by the HubDirectiveThe path to the log file; the line is mandatory, and it also sets the location of the monitor and SNMP logs.min-free-space<spool>set by the HubDirectiveWhen free space falls below the threshold, the directory stops accepting mail; when space comes back, receiving resumes by itself.name-serverGlobalDirectiveSets name server addresses; the line is repeated, and the engine goes through them in rotation. If not set, the operating system’s resolvers are used.openssl-security-levelGlobalDirectiveA number from 0 to 5 below which OpenSSL refuses to work with keys, certificates and protocol versions; 1 by default.api-key<signals>DirectiveExactly forty hexadecimal characters; without it the node will not start at all.deliver-only<spool>set by the HubDirectiveThe directory is drained by delivery, and new messages are not written to it; made for bringing up the spool of a failed server.log-auto-rotationGlobalDirectiveThe switch for daily log file rotation; on by default.volume-audit-api-keyGlobalDirectiveMandatory under a license that counts volume: with this key the node authenticates itself when sending data to the vendor. It is issued together with such a license.customer-id<signals>DirectiveBefore version 5.5 it was required for engine-side tracking; since 5.5 it is not needed.delete-file-holders<spool>set by the HubDirectiveHolders are files the engine leaves in the spool directory to save I/O; the line decides whether to remove them after a message is delivered.spool-min-free-spaceGlobaldeprecatedDirectiveIt set the threshold for all spool directories at once; replaced by the line of the same name inside the directory block.How the node decides whether to let an HTTP request incriticalMechanismTwo ways to identify yourself — an access level by address and a key; the key is stronger and works from any address.A name, an address and a greeting name — what a sending address consists ofcriticalMechanismThe definition is small, and two of its properties are easy to miss — omitting the address line silently inherits the node’s settings, and several addresses in one block rotate round-robin.How to turn a sending plan into hardwareMechanismTwo constants for sizing any node: about 2 KB of memory per queued recipient and spool space proportional to the total size of the messages.Cloud restrictionsMechanismClouds restrict outbound mail on port 25 until you ask them to lift the limit, and mailbox providers treat their address ranges with suspicion.The activation key is a prerequisite for installation, not a step after itMechanismWithout an activation key from SparkPost support the engine neither installs nor runs, and the license tier sets the outbound connection ceiling: on Standard everything above 200 is ignored.The node needs a resolver that does all the work itselfMechanismThe engine requires recursive name resolution; a resolver that answers with a referral to another server forces the query to be repeated and triggers a log warning.What makes a virtual machine riskyMechanismRunning on a virtual machine is possible, but the manual does not recommend it without sufficient hardware and properly tuned hypervisor settings: under load the node may stop responding.A license for a fleet, not for a serverMechanismThe license is not bound to a server: it is installed on as many machines as the instance limit allows, and the nodes send volume statistics to the vendor every hour.What protects the web monitor and what that protection is notMechanismThree different protections — an address list, encryption and advice not to expose the monitor to the internet; there is not a single account.The encryption library is part of the distribution, not the systemMechanismOpenSSL comes inside the PowerMTA distribution, so the set of versions and ciphers is determined by the product version, not by system libraries.Who took the portMechanismTwo listeners do not fit on one port: if the port is already taken, the node will not come up, and the cause will be only in the log.Third-party components of the engineMechanismPowerMTA runs on five third-party libraries — PCRE, OpenSSL, ICU, gumbo-parser and prometheus-cpp; their behavior is determined by the engine build.Engine version rollback and configuration via the APIMechanismWhen PowerMTA is rolled back to a version without the configuration API, what was created through it becomes invisible but is not deleted; the manual’s table says what survives a rollback between versions with the API.Running in an imageMechanismExperimental running of the engine in a Linux container: the package, license and configuration are installed when building the image or attached at startup.A fake receiver inside the node itselfMechanismThe node listens on its own port and pretends to be someone else’s server: messages go nowhere, but the load is real.Installing on LinuxcriticalProcedureInstall the vendor’s package with the standard package manager, put the license key in place, check the configuration against the requirements and start the engine once — after that it comes up by itself.Prepare a machine for the enginecriticalProcedureFive requirements and a supported operating system must be in place before installation: a static address with a name, a reachable resolver, synchronized time, sized hardware and a license key.How to enable DKIM signing from scratchcriticalProcedureEight steps: domain, selector, key, permissions, DNS record, declaration, enabling and routing.Node backup and restoreProcedureFive directories make up the node’s recoverable state; restoring means stopping the engine, putting the directories back and starting it again.Running without root privilegesProcedureMoving the engine to run as a separate user: the line itself, ports above one thousand twenty-four, raised limits on files and processes, and changing the owner of five directories.Investigating a startup failureProcedureThe order of looking for the cause when the engine does not come up: the separate startup error file, the main log, a console run with output to the screen.Upgrading the engineProcedureBefore upgrading, make sure the license file holds a key valid for the new version and that the support term has not expired — and only then upgrade the package.Removing the engineProcedureRemoving the package with the standard package manager. The node’s state stays on disk.Deployment in the cloudProcedureInstalling in the cloud adds a few conditions of its own to the ordinary installation: choosing the machine type by estimate, a fixed address and a lifted restriction on the outgoing mail port.Installing on WindowsProcedureInstallation with a wizard, with the same license and configuration requirements as on Linux.GlobalcriticalConfiguration blockLines that belong not to a queue but to the instance itself: ceilings, the spool, listeners, logging, the license and the web monitor.<spool>Configuration blockThe directory where the engine keeps message files while they wait for delivery; there can be several directories, each with its own priority and free space threshold.check spfCommandReturns the same verdict as the recipient — based on the address, the greeting name and the return address.resolveCommandQueries a domain’s MX records and addresses and with –connect connects to the first available mail host.pmtad –debugCommandStarts the engine in the foreground, printing messages to the screen instead of a file.show versionCommandPrints the version, the build date and the revision.deregisterCommandEnds the relationship with the vendor’s console.registerCommandEstablishes a relationship between the node and the vendor’s management console.Addresses present on the machineAPI endpointLists the addresses configured on the machine itself.Web monitor rootAPI endpointReturns the monitor’s start page as a structure: installation information and the top queue domains.Name cacheMetricThe number of names in the cache and the number of queries waiting for a response; separately, active queries.Spool reading at startupMetricThe share of the spool read completed at startup, in percent.LicenseMonitor screenShows the engine license and lets you add or replace it.Where the node writes why it did not startFileA separate file with the startup failure message — the first thing to read when the engine does not come up after installation or a configuration edit.License fileFileThe license key as a plain file — /etc/pmta/license on Linux, license.dat in the installation directory on Windows; on Windows ASCII is mandatory, not Unicode.