Demo
Demo

Knowledge base

PMTA knowledge base›Block <virtual-mta>›Directive§ 3.3.12.7

smtp-proxy-source-host

<virtual-mta>set by the Hub

The proxy sending setting for this sending address
in the configuration this is a linesmtp-proxy-source-hostinside the block <virtual-mta>
The same name 1:Global<virtual-mta>— some of them are other settings, some are the same one
A proxy per sending identity

The syntax and the order of the four words are the same as at the node level. What changes is the scope — and a prohibition appears.

The node set is replaced entirely, just as with the regular form: what is written here applies to this sending address’s messages, and the common setting is not applied to them.

An accompanying prohibition. If the directive applies to this sending address — set here or inherited from the node — then smtp-source-host and use-proxy are not allowed in this block. The second case matters more than the first: an inherited proxy is not visible in the block itself, and the regular form can no longer be put next to it.

The natural unit of a proxy fleet. One sending address — one rented address — one identity: that way accounting, limits and address health are calculated from what the recipient saw.

The main trap. The name in the greeting must match the reverse record of the proxy client address — the third word of the line — not the local address from the first. A dig -x check on the local address will show a match that the recipient will never see.
What the Hub does. It writes it — the whole proxy gate stands on this line. For every proxy whose DNS records have propagated, a sending address of its own, proxy-<tag>, is created in /etc/pmta/proxy.txt, and the line carries four values: the node’s local address, the gate’s address on the node, the proxy tag — its external address — and the greeting name. Next to it sit proxy-protocol 2, proxy-include-tlv domain and the domain signature.

The tag links this file with the gate table /etc/hubgate/upstreams.tsv: the engine checks it only for form, while the gate uses it to choose which proxy to go out through. If the files diverge, mail through such an address will not go at all.

Recommended values

The values are the same as in the definition. What is decided here specifically:

Entry Consequence
a line in the block the node set is replaced for this stream
nothing written the node set is inherited — together with the ban on the regular form
several lines an identity made of several proxy addresses, rotated

One sending address — one rented address. Rotation within an identity takes away the ability to monitor addresses individually, and in a proxy fleet that is exactly what is needed: addresses change most often.

The set replacement and the companion ban come from the manual. “One sending address per rented address” is our rule — that is how the Hub’s gate is built.
Example configuration
# the whole sending address goes through the proxy
<virtual-mta mta2.port25.com>
    smtp-proxy-source-host 2.3.4.5 my.proxy.com:5000 10.1.2.3 mta2.port25.com</virtual-mta>
The manual’s example. The recipient will see a connection from 10.1.2.3; the reverse record is checked against it. smtp-source-host and use-proxy are now not allowed in this block.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends2 mistakes▶

Adding the regular form without noticing an inherited proxy form

§ 3.3.1.23

What it costsThe prohibition also applies to an inherited setting. In the block, smtp-source-host looks lonely and legitimate, yet the configuration is not applied.
How to spot itThe reload fails, and the error points to a sending address that has no proxy line.
How to do it rightCheck whether the proxy form is set at the node level: it is inherited by all sending addresses where it is not overridden.

Checking the reverse record against the local address

§ 11.3

What it costsThe recipient sees the proxy client address. A name that matches the local reverse record matches nothing for the recipient.
How to spot itComplaints about a name and reverse record mismatch, even though dig -x on the node shows a match.
How to do it rightCheck against the third word of the line. In a proxy fleet it is the only address the recipient knows about at all.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
smtp-proxy-source-host <see-global>
Values
a local address or CIDR, the proxy with a port, the client address (optionally with a port), a fully qualified domain name
Applying
reload, no restart needed
Queue
will not touch what is already queued
Where to write it
<virtual-mta>
How many times
may be repeated
Everything here comes from the manual, with the section.
Inheritance
Here the entry replaces the node set for this sending address’s messages; between them there is a pool level — <virtual-mta-pool> hands its value out to members, and a member overrides it with its own. The prohibition is inherited too: a proxy form that a sending address got from the node closes both smtp-source-host and use-proxy in it — even though it is not visible in the block itself.
⇄

Related directives

2 relations

Same name in other blocks

smtp-proxy-source-hostGlobalThe manual defines the directive at the node level; here is only what writing it inside a sending address changes. § 3.3.1.23

Applies to

The sending address — what it is made ofOne of the settings that make up a sending identity — its proxy variant. § 3.3.12.7

How to check on the node
Look at the address the recipient will see, not the local one. What is configured:
pmta show vmta-settings shop-via-proxy
Compare the third word of the line — the proxy client address — with dig -x 10.1.2.3 +short. The node does not check whether this address is actually up on the proxy: look at the proxy.
◇

What else to read

3 articles

◇Headers the sender uses to control deliverySix control headers let the submitting side choose a stream, tag a message with a job, set signing options and the key, the envelope identifier and the schedule; each is allowed separately and per source.◇Backoff mode — the queue's second personalityA queue that a receiver has started refusing switches to a parallel set of limits, retries and routes — ten directives that act only in this mode.◇Warm-up built into the engineA warmed-up address hands the first N messages of the day for each receiver to its cold partner; the partner sends them itself and builds history.

In the Hub
Value
The Hub picks it itself — pace, warm-up stage, metrics
Cost of a mistake
reversible: harms only while it is set
Scenarios
Sending address rotation
Neighboring settings of the block <virtual-mta>:host-namedomain-keysmtp-source-hostproxy-include-tlvinclude-headers-fromAll 15 directives of the block →