Knowledge base
allow-starttls<source>set by the HubDirectivePermission to advertise STARTTLS to this source’s clients; the default is not to allow it, and then submission goes in plain text.openssl-security-levelGlobalDirectiveA number from 0 to 5 below which OpenSSL refuses to work with keys, certificates and protocol versions; 1 by default.require-starttls<domain>set by the HubDirectiveWith this line the node drops the connection instead of sending in plain text; the default is to send.smtp-server-tls-certificateGlobalset by the HubDirectiveAn X.509 certificate in PEM format — from a file or from a secrets store; the private key password is optional and can also be in the store.smtp-tls-min-version<domain>DirectiveThe oldest protocol version the node is willing to negotiate when sending; the default is TLS 1.1.use-dane<domain>DirectiveThe node reads the recipient domain’s DANE records, requires encryption if the domain requires it, and checks the certificate against the fingerprint from DNS; the default is off.use-mta-sts<domain>set by the HubDirectiveThe node fetches the recipient domain’s policy and, if it is in enforce mode, delivers only when the MX matches, the connection is encrypted and the certificate is verified; the default is off.use-starttls<domain>set by the HubDirectiveEnables STARTTLS if the receiver offers it; the default is on.require-starttls<source>DirectiveWith this line the client must perform STARTTLS before anything except the greeting and service commands; the default is not to require it.smtp-client-certificate<domain>DirectiveThe client certificate the node shows the receiver on an outgoing connection; its password is set as the second word and is optional.smtp-server-tls-min-versionGlobalDirectiveThe oldest protocol version the node is willing to accept from a submitting client; the default is TLS 1.2, stricter than for sending.smtp-tls-ca-file<domain>DirectiveA file with root certificates against which the chain presented by the receiver is verified; by default the list from the distribution is used.smtp-server-tls-ca-fileGlobalDirectiveA file with root certificates against which certificates presented by clients on incoming connections are verified.smtp-server-tls-cipher-server-preferenceGlobalDirectiveWith this line the cipher is chosen by the order in our configuration, not by the client’s order; the default is by the client.smtp-server-tls-ciphersGlobalDirectiveThe list of allowed ciphers in OpenSSL notation for incoming connections; applies to versions up to TLS 1.2, 1.3 has its own list.smtp-server-tls-max-versionGlobalDirectiveThe newest protocol version the node is willing to accept from a submitting client; unlimited by default.log-tls<domain>DirectiveDetails of encryption negotiation with the receiver in the node’s log; the default is not to log.smtp-server-tls-allow-tlsv1GlobaldeprecatedDirectiveA separate switch for one protocol version for receiving; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-server-tls-allow-tlsv1.1GlobaldeprecatedDirectiveA separate switch for one protocol version for receiving; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-server-tls-allow-tlsv1.2GlobaldeprecatedDirectiveA separate switch for one protocol version for receiving; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-server-tls-allow-tlsv1.3GlobaldeprecatedDirectiveA separate switch for one protocol version for receiving; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-server-tls-v1.3-ciphersuitesGlobalDirectiveA separate list for version 1.3 on incoming connections; the default lists five modern suites.smtp-tls-allow-tlsv1<domain>deprecatedDirectiveA separate switch for one protocol version; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-tls-allow-tlsv1.1<domain>deprecatedDirectiveA separate switch for one protocol version; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-tls-allow-tlsv1.2<domain>deprecatedDirectiveA separate switch for one protocol version; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-tls-allow-tlsv1.3<domain>deprecatedDirectiveA separate switch for one protocol version; deprecated in PowerMTA 5.5 in favor of a pair of range bounds.smtp-tls-ciphers<domain>DirectiveA list of allowed ciphers in OpenSSL notation; applies to versions up to TLS 1.2, there is a separate line for 1.3.smtp-tls-max-version<domain>DirectiveThe newest protocol version the node is willing to negotiate when sending; unlimited by default.smtp-tls-v1.3-ciphersuites<domain>DirectiveA separate list for version 1.3 — its suites are structured differently than those of previous versions.tls-allow-sslv3<smtp-listener>deprecatedDirectivePowerMTA no longer supports SSLv3; the line is kept only for configuration compatibility.tls-allow-sslv3<transmissions-api-listener>deprecatedDirectivePowerMTA no longer supports SSLv3; the line is kept only for configuration compatibility.tls-allow-tlsv1<smtp-listener>deprecatedDirectiveA separate switch for one protocol version for the listener; deprecated in PowerMTA 5.5 in favor of a pair of bounds.tls-allow-tlsv1<transmissions-api-listener>deprecatedDirectiveA separate switch for one protocol version for the HTTP API input; deprecated in PowerMTA 5.5 in favor of a pair of bounds.tls-allow-tlsv1.1<smtp-listener>deprecatedDirectiveA separate switch for one protocol version for the listener; deprecated in PowerMTA 5.5 in favor of a pair of bounds.tls-allow-tlsv1.1<transmissions-api-listener>deprecatedDirectiveA separate switch for one protocol version for the HTTP API input; deprecated in PowerMTA 5.5 in favor of a pair of bounds.tls-allow-tlsv1.2<smtp-listener>deprecatedDirectiveA separate switch for one protocol version for the listener; deprecated in PowerMTA 5.5 in favor of a pair of bounds.tls-allow-tlsv1.2<transmissions-api-listener>deprecatedDirectiveA separate switch for one protocol version for the HTTP API input; deprecated in PowerMTA 5.5 in favor of a pair of bounds.tls-allow-tlsv1.3<transmissions-api-listener>deprecatedDirectiveA separate switch for one protocol version for the HTTP API input; deprecated in PowerMTA 5.5 in favor of a pair of bounds.tls-allow-tlsv1.3<smtp-listener>deprecatedDirectiveA separate switch for one protocol version for the listener; deprecated in PowerMTA 5.5 in favor of a pair of bounds.The receiver declares an encryption requirement in its DNS zoneMechanismThe node looks at the recipient domain’s DANE records and, if STARTTLS is required, sends only over an encrypted channel with a certificate verified by fingerprint.The receiver declares an encryption requirement on its websiteMechanismThe node fetches the recipient domain’s policy over HTTPS and, if it is in enforce mode, delivers only when the MX matches, the connection is encrypted and the certificate is verified.The encryption library is part of the distribution, not the systemMechanismOpenSSL comes inside the PowerMTA distribution, so the set of versions and ciphers is determined by the product version, not by system libraries.What is not allowed in FIPS modeMechanismIn FIPS mode only a validated set of algorithms is available: some familiar encryption and signing settings become unavailable.Submission over HTTPS on its own listener, modeled on SparkPostMechanismA separate entry point: its own listener with a certificate, its own keys and a reserved source name through which the usual submission settings apply to such mail.