smtpd.conf - Man Page

action name method [options]

When the queue runner processes an envelope from the mail queue, it carries out the action name, selected by the match ... action directive when the message was received. The action directive provides configuration data for delivery attempts. Required lookups are performed at the time of each delivery attempt. Consequently, changing an action directive or the files it references and restarting the smtpd(8) daemon causes the changes to take effect for subsequent delivery attempts for the respective dispatcher name, even for messages that were already stuck in the queue prior to the configuration changes.

The delivery method parameter may be one of the following:

The local delivery methods support additional options:

The relay delivery methods also support additional options:

admd authservid

The Administrative Management Domain this mail server belongs to. The authservid will be forwarded to filters using it to identify or mark authentication-results headers. If omitted, it defaults to the server name.

bounce warn-interval delay [, delay ...]

Send warning messages to the envelope sender when temporary delivery failures cause a message to remain in the queue for longer than delay. Each delay parameter consists of a positive decimal integer and a unit s, m, h, or d. At most four delay parameters can be specified. The default is Qq bounce warn-interval 4h, sending a single warning after four hours.

ca caname cert cafile

Associate the Certificate Authority (CA) certificate file cafile with ca entry caname. The ca entry can be referenced in listener rules and relay actions.

filter chain-name chain {filter-name [, ...]}

Register a chain of filters chain-name, consisting of the filters listed in filter-name. Filters in a filter chain are executed in order of declaration for each phase that they are registered for. A filter chain may be used in place of a filter for any directive except filter chains themselves.

filter filter-name phase phase-name match conditions decision

Register a filter filter-name. A decision about what to do with the mail is taken at phase phase-name when matching conditions. Phases, matching conditions, and decisions are described in Mail Filtering , below.

filter filter-name proc proc-name

Register Qq proc filter filter-name backed by the proc-name process.

filter filter-name proc-exec command

Register and execute Qq proc filter filter-name from command, conformant with the smtpd-filters(7) API. If command starts with a slash it is executed with an absolute path, otherwise it will be run from “/usr/libexec/opensmtpd”.

include Qq pathname

Replace this directive with the content of the additional configuration file at the absolute pathname.

listen on interface [family] [options]

Listen on the interface for incoming connections, using the same syntax as ifconfig(8). The interface parameter may also be an interface group, an IP address, or a domain name. Listening can optionally be restricted to a specific address family, which can be either inet4 or inet6.

The options are as follows:

auth [Pf < authtable >]

Support SMTPAUTH: clients may only start SMTP transactions after successful authentication. Users are authenticated against either their own normal login credentials or a credentials table authtable, the format of which is described in table(5).

auth-optional [Pf < authtable >]

Support SMTPAUTH optionally: clients need not authenticate, but may do so. This allows a listen on directive to both accept incoming mail from untrusted senders and permit outgoing mail from authenticated users (using match auth). It can be used in situations where it is not possible to listen on a separate port (usually the submission port, 587) for users to authenticate.

ca caname

For secure connections, use the CA certificate associated with caname (declared in a ca directive) as the CA certificate when verifying client certificates.

filter name

Apply filter name on connections handled by this listener.

hostname hostname

Use hostname in the greeting banner instead of the default server name.

hostnames Pf < names >

Override the server name for specific addresses. The names table contains a mapping of IP addresses to hostnames. If the address on which the connection arrives appears in the mapping, the associated hostname is used.

mask-src

Omit the from part when prepending “Received” headers.

no-dsn

Disable the DSN (Delivery Status Notification) extension.

pki pkiname

For secure connections, use the certificate associated with pkiname (declared in a pki directive) to prove a mail server's identity. This option can be used multiple times to provide alternate certificates for SNI.

port [port]

Listen on the given port instead of the default port 25.

proxy-v2

Support the PROXYv2 protocol, appropriately rewriting the source address received from proxy.

received-auth

In “Received” headers, report whether the session was authenticated and by which local user.

senders Pf < users >[masquerade]

Look up the authenticated user in the users mapping table to find the email addresses that user is allowed to submit mail as. In addition, if the masquerade option is provided, the From header is rewritten to match the sender provided in the SMTP session.

smtps

Support SMTPS, by default on port 465. Mutually exclusive with tls.

tag tag

Clients connecting to the listener are tagged with the given tag.

tls

Support STARTTLS, by default on port 25. Mutually exclusive with smtps.

tls-require [verify]

Like tls, but force clients to establish a secure connection before being allowed to start an SMTP transaction. With the verify option, clients must also provide a valid certificate to establish an SMTP session.

protocols protostr

Define the protocol versions to be used for TLS sessions. Refer to the tls_config_parse_protocols(3) manpage for the format of protostr.

ciphers cipherstr

Define the list of ciphers that may be used for TLS sessions. Refer to the tls_config_set_ciphers(3) manpage for the format of cipherstr.

listen on socket [options]

Listen for incoming SMTP connections on the Unix domain socket /var/run/smtpd.sock. This is done by default, even if the directive is absent.

The options are as follows:

filter name

Apply filter name on connections handled by this listener.

mask-src

Omit the from part when prepending “Received” headers.

no-dsn

Disable the DSN (Delivery Status Notification) extension.

tag tag

Clients connecting to the listener are tagged with the given tag.

match options action name

If at least one mail envelope matches the options of one match action directive, receive the incoming message, put a copy into each matching envelope, and atomically save the envelopes to the mail spool for later processing by the respective dispatcher name.

The following matching options are supported and can all be negated:

[ !]

for any Specify that session may address any destination.

[ !]

for local Specify that session may address any local domain. This is the default, and may be omitted.

[ !]

for domain domain | Pf < domain > Specify that session may address the string or list table domain.

[ !]

for domain regex domain | Pf < domain > Specify that session may address the regex or regex table domain.

[ !]

for rcpt-to recipient | Pf < recipient > Specify that session may address the string or list table recipient.

[ !]

for rcpt-to regex recipient | Pf < recipient > Specify that session may address the regex or regex table recipient.

[ !]

from any Specify that session may originate from any source.

[ !]

from auth Specify that session may originate from any authenticated user, no matter the source IP address.

[ !]

from auth user | Pf < user > Specify that session may originate from authenticated user or user list user, no matter the source IP address.

[ !]

from auth regex user | Pf < user > Specify that session may originate from authenticated regex or regex list user, no matter the source IP address.

[ !]

from local Specify that session may only originate from a local IP address, or from the local enqueuer. This is the default, and may be omitted.

[ !]

from mail-from sender | Pf < sender > Specify that session may originate from sender or sender list sender, no matter the source IP address.

[ !]

from mail-from regex sender | Pf < sender > Specify that session may originate from regex or regex list sender, no matter the source IP address.

[ !]

from rdns Specify that session may only originate from an IP address that resolves to a reverse DNS.

[ !]

from rdns hostname | Pf < hostname > Specify that session may only originate from an IP address that resolves to a reverse DNS matching string or list string hostname.

[ !]

from rdns regex hostname | Pf < hostname > Specify that session may only originate from an IP address that resolves to a reverse DNS matching regex or list regex hostname.

[ !]

from socket Specify that session may only originate from the local enqueuer.

[ !]

from src address | Pf < address > Specify that session may only originate from string or list table address which can be a specific address or a subnet expressed in CIDR-notation.

[ !]

from src regex address | Pf < address > Specify that session may only originate from regex or regex table address which can be a specific address or a subnet expressed in CIDR-notation.

In addition, the following transaction options may be matched:

[ !]

auth Matches transactions which have been authenticated.

[ !]

auth username | Pf < username > Matches transactions which have been authenticated for user or user list username.

[ !]

auth regex username | Pf < username > Matches transactions which have been authenticated for regex or regex list username.

[ !]

helo helo-name | Pf < helo-name > Specify that session's HELO / EHLO should match the string or list table helo-name.

[ !]

helo regex helo-name | Pf < helo-name > Specify that session's HELO / EHLO should match the regex or regex table helo-name.

[ !]

mail-from sender | Pf < sender > Specify that transaction's MAIL FROM should match the string or list table sender.

[ !]

mail-from regex sender | Pf < sender > Specify that transaction's MAIL FROM should match the regex or regex table sender.

[ !]

rcpt-to recipient | Pf < recipient > Specify that transaction's RCPT TO should match the string or list table recipient.

[ !]

rcpt-to regex recipient | Pf < recipient > Specify that transaction's RCPT TO should match the regex or regex table recipient.

[ !]

tag tag Matches transactions tagged with the given tag.

[ !]

tag regex tag Matches transactions tagged with the given tag regex.

[ !]

tls Specify that transaction should take place in a TLS channel.

match options reject

Reject the incoming message during the SMTP dialogue. The same options are supported as for the match action directive.

mda wrapper name command

Associate command with the mail delivery agent wrapper named name. When a local delivery specifies a wrapper, the command associated with the wrapper will be executed instead. The command may contain format specifiers (see .B Format Specifiers .)

mta max-deferred number

When delivery to a given host is suspended due to temporary failures, cache at most number envelopes for that host such that they can be delivered as soon as another delivery succeeds to that host. The default is 100.

pki pkiname cert certfile

Associate certificate file certfile with pki entry pkiname. The pki entry defines a keypair configuration that can be referenced in listener rules and relay actions.

A certificate chain may be created by appending one or many certificates, including a Certificate Authority certificate, to certfile. The creation of certificates is documented in starttls(8).

pki pkiname key keyfile

Associate the key located in keyfile with pki entry pkiname.

pki pkiname dhe params

Specify the DHE parameters to use for DHE cipher suites with pki entry pkiname. Valid parameter values are none, legacy, and auto. For legacy, a fixed key length of 1024 bits is used, whereas for auto, the key length is determined automatically. The default is none, which disables DHE cipher suites.

proc proc-name command

Register an external process named proc-name from command, conformant with the smtpd-filters(7) API. Such processes may be used to share the same instance between multiple filters. If command starts with a slash it is executed with an absolute path, otherwise it will be run from “/usr/libexec/opensmtpd”.

queue compression

Store queue files in a compressed format. This may be useful to save disk space.

queue encryption [key]

Encrypt queue files with EVP_aes_256_gcm(3). If no key is specified, it is read with getpass(3). If the string stdin or a single dash (Ql -) is given instead of a key, the key is read from the standard input.

queue ttl delay

Set the default expiration time for temporarily undeliverable messages, given as a positive decimal integer followed by a unit s, m, h, or d. The default is four days (4d.)

smtp ciphers control

Set the control string for SSL_CTX_set_cipher_list(3). The default is Qq HIGH:!aNULL:!MD5.

smtp limit max-mails count

Limit the number of messages to count for each session. The default is 100.

smtp limit max-rcpt count

Limit the number of recipients to count for each transaction. The default is 1000.

smtp max-message-size size

Reject messages larger than size, given as a positive number of bytes or as a string to be parsed with scan_scaled(3). The default is Qq 35M.

smtp sub-addr-delim character

When resolving the local part of a local email address, ignore the ASCII character and all characters following it. The default is Ql +.

srs key secret

Set the secret key to use for SRS, the Sender Rewriting Scheme.

srs key backup secret

Set a backup secret key to use as a fallback for SRS. This can be used to implement SRS key rotation.

srs ttl delay

Set the time-to-live delay for SRS envelopes. After this delay, a bounce reply to the SRS address will be discarded to limit risks of forged addresses. The default is four days (4d.)

table name [type:] pathname

Tables provide additional configuration information for smtpd(8) in the form of lists or key-value mappings. The format of the entries depends on what the table is used for. Refer to table(5) for the exhaustive documentation.

Each table is identified by an arbitrary, unique name.

If the type is db, information is stored in a file created with makemap(8); if it is file or omitted, information is stored in a plain text file using the format described in table(5). The pathname to the file must be absolute.

table name {value [, ...]}

Instead of using a separate file, declare a list table containing the given static value s. The table must contain at least one value and may declare multiple values as a comma-separated (whitespace optional) list.

table name {key=value [, ...]}

Instead of using a separate file, declare a mapping table containing the given static key -value pairs. The table must contain at least one key-value pair and may declare multiple pairs as a comma-separated (whitespace optional) list.