# smtpd.conf

## NAME



           **smtpd.conf** — SMTP daemon configuration file
    


## DESCRIPTION



           **smtpd.conf** is the configuration file for the mail daemon _smtpd_(8).
    
           When mail arrives, each “RCPT TO:” command generates a mail
           envelope.  If an envelope matches any of a pre-designated set of
           criteria (using the **match** directive), the message is accepted for
           delivery.  A copy of the message, as well as its associated
           envelopes, is saved in the mail queue and later dispatched
           according to an associated set of actions (using the **action**
           directive).  If an envelope does not match any options, it is
           rejected.  The match rules are evaluated sequentially, with the
           first match winning.
    
           The format of the configuration file is fairly flexible.  The
           current line can be extended over multiple lines using a backslash
           (‘\’).  Comments can be put anywhere in the file using a hash mark
           (‘#’), and extend to the end of the current line.  Care should be
           taken when commenting out multi-line text: the comment is
           effective until the end of the entire block.  Argument names not
           beginning with a letter, digit, or underscore, as well as reserved
           words (such as **listen** , **match** , and **port**), must be quoted.
           Arguments containing whitespace should be surrounded by double
           quotes (").
    
           A macro is defined with a command of the form _name_ =_value_.  The
           macro _name_ can contain letters, digits, and underscores and cannot
           be a reserved word.  Within unquoted arguments, the string $_name_
           is later expanded to _value_.
    
           For example:
    
                 lan_addr = "192.168.0.1"
                 listen on $lan_addr
                 listen on $lan_addr tls auth
    
           The syntax of **smtpd.conf** is described below.
    
           **action** _name method_ [_options_]
                   When the queue runner processes an envelope from the mail
                   queue, it carries out the **action** _name_ , selected by the
                   **match**... **action** directive when the message was received.
                   The **action** directive provides configuration data for
                   delivery attempts.  Required lookups are performed at the
                   time of each delivery attempt.  Consequently, changing an
                   **action** directive or the files it references and restarting
                   the _smtpd_(8) daemon causes the changes to take effect for
                   subsequent delivery attempts for the respective dispatcher
                   _name_ , even for messages that were already stuck in the
                   queue prior to the configuration changes.
    
                   The delivery _method_ parameter may be one of the following:
    
                   **expand-only**
                           Only accept the message if a delivery method was
                           specified in an aliases or _.forward_ file.
    
                   **forward-only**
                           Only accept the message if the recipient results
                           in a remote address after the processing of
                           aliases or forward file.
    
                   **lmtp** _destination_ [**rcpt-to**]
                           Deliver the message to an LMTP server at
                           _destination_.  The location may be expressed as
                           host:port or as a UNIX socket.
    
                           Optionally, **rcpt-to** might be specified to use the
                           recipient email address (after expansion) instead
                           of the local user in the LMTP session as RCPT TO.
    
                   **maildir**[_pathname_] [**junk**]
                           Deliver the message to the maildir in _pathname_ if
                           specified, or by default to _~/Maildir_.
    
                           The _pathname_ may contain format specifiers that
                           are expanded before use (see “FORMAT SPECIFIERS”).
    
                           If the **junk** argument is provided, the message will
                           be moved to the ‘Junk’ folder if it contains a
                           positive ‘X-Spam’ header.  This folder will be
                           created under _pathname_ if it does not yet exist.
    
                   **mbox** Deliver the message to the user's mbox with
                           _mail.local_(8).
    
                   **mda** _command_
                           Delegate the delivery to a _command_ that receives
                           the message on its standard input (see “MDA
                           COMMANDS”).
    
                           The _command_ may contain format specifiers that are
                           expanded before use (see “FORMAT SPECIFIERS”).
    
                   **relay** Relay the message to another SMTP server.
    
                   The local delivery methods support additional options:
    
                   **alias** <_table_ >
                           Use the mapping _table_ for _aliases_(5) expansion.
    
                   **ttl** _n_{**s** |**m** |**h** |**d**}
                           Specify how long a message may remain in the
                           queue.
    
                   **user** _username_
                           Specify the _username_ for performing the delivery,
                           to be looked up with _getpwnam_(3).
    
                           This is used for virtual hosting where a single
                           username is in charge of handling delivery for all
                           virtual users.
    
                           This option is not usable with the **mbox** delivery
                           method.
    
                           Only the delivery user's _.forward_ file will be
                           processed.
    
                   **userbase** <_table_ >
                           Use the mapping _table_ for user lookups instead of
                           the _getpwnam_(3) function.
    
                           The **userbase** does not apply to the **user** option.
    
                   **virtual** <_table_ >
                           Use the mapping _table_ for virtual expansion.  The
                           aliasing table format is described in _table_(5).
    
                   **wrapper** _name_
                           Use the wrapper specified in **mda wrapper**.
    
                   The relay delivery methods also support additional
                   options:
    
                   **backup** Operate as a backup mail exchanger delivering
                           messages to any mail exchanger with higher
                           priority.
    
                   **backup mx** _name_
                           Operate as a backup mail exchanger delivering
                           messages to any mail exchanger with higher
                           priority than mail exchanger identified as _name_.
    
                   **ca** _caname_
                           For secure connections, use the certificate
                           authority associated with _caname_ (declared in a **ca**
                           directive) to validate the server's identity.
    
                   **helo** _heloname_
                           Advertise _heloname_ as the hostname to other mail
                           exchangers during the HELO phase.
    
                   **helo-src** <_table_ >
                           Use the mapping _table_ to look up a hostname
                           matching the source address, to advertise during
                           the HELO phase.
    
                   **domain** <_domains_ >
                           Do not perform MX lookups but look up destination
                           domain in _domains_ and use matching relay url as
                           relay host.
    
                   **host** _relay-url_
                           Do not perform MX lookups but relay messages to
                           the relay host described by _relay-url_.  The format
                           for _relay-url_ is [_proto_ ://[_label_ @]]_host_[:_port_].
                           The following protocols are available:
    
                           smtp        Normal SMTP session with opportunistic
                                       STARTTLS (the default).
                           smtp+tls    Normal SMTP session with mandatory
                                       STARTTLS.
                           smtp+notls  Plain text SMTP session without TLS.
                           lmtp        LMTP session.  _port_ is required.
                           smtps       SMTP session with forced TLS on
                                       connection.  The default port is 465.
    
                           Unless noted, _port_ defaults to 25.
    
                           The _label_ corresponds to an entry in a credentials
                           table, as documented in _table_(5).  It is used with
                           the “smtp+tls” and “smtps” protocols for
                           authentication.  Server certificates for those
                           protocols are verified by default.
    
                   **pki** _pkiname_
                           For secure connections, use the certificate
                           associated with _pkiname_ (declared in a **pki**
                           directive) to prove the client's identity to the
                           remote mail server.
    
                   **srs** When relaying a mail resulting from a forward, use
                           the Sender Rewriting Scheme to rewrite sender
                           address.
    
                   **tls**[**no-verify**]
                           Require TLS to be used when relaying, using
                           mandatory STARTTLS by default.  When used with a
                           smarthost, the protocol must not be
                           “smtp+notls://”.  If **no-verify** is specified, do
                           not require a valid certificate.
    
                   **protocols** _protostr_
                           Define the protocol versions to be used for TLS
                           sessions.  Refer to the
                           _tls_config_parse_protocols_(3) manpage for the
                           format of _protostr_.
    
                   **ciphers** _cipherstr_
                           Define the list of ciphers that may be used for
                           TLS sessions.  Refer to the
                           _tls_config_set_ciphers_(3) manpage for the format
                           of _cipherstr_.
    
                   **auth** <_table_ >
                           Use the mapping _table_ for connecting to _relay-url_
                           using credentials.  This option is usable only
                           with **host** option.  The credential table format is
                           described in _table_(5).
    
                   **mail-from** _mailaddr_
                           Use _mailaddr_ as the MAIL FROM address within the
                           SMTP transaction.
    
                   **src** _sourceaddr_ | <_sourceaddr_ >
                           Use the string or list table _sourceaddr_ for the
                           source IP address, which is useful on machines
                           with multiple interfaces.  If the list contains
                           more than one address, all of them are used in
                           such a way that traffic is routed as efficiently
                           as possible.
    
           **admd** _authservid_
                   The Administrative Management Domain this mail server
                   belongs to.  The authservid will be forwarded to filters
                   using it to identify or mark authentication-results
                   headers.  If omitted, it defaults to the server name.
    
           **bounce warn-interval** _delay_ [, _delay ..._]
                   Send warning messages to the envelope sender when
                   temporary delivery failures cause a message to remain in
                   the queue for longer than _delay_.  Each _delay_ parameter
                   consists of a positive decimal integer and a unit **s** , **m** , **h** ,
                   or **d**.  At most four _delay_ parameters can be specified.
                   The default is "**bounce warn-interval** 4h", sending a single
                   warning after four hours.
    
           **ca** _caname_ **cert** _cafile_
                   Associate the Certificate Authority (CA) certificate file
                   _cafile_ with ca entry _caname_.  The ca entry can be
                   referenced in **listen on** and **action ... relay** rules.
    
           **filter** _chain-name_ **chain**{_filter-name_ [, _..._]}
                   Register a chain of filters _chain-name_ , consisting of the
                   filters listed in _filter-name_.  Filters in a filter chain
                   are executed in order of declaration for each phase that
                   they are registered for.  A filter chain may be used in
                   place of a filter for any directive except filter chains
                   themselves.
    
           **filter** _filter-name_ **phase** _phase-name_ **match** _conditions decision_
                   Register a filter _filter-name_.  A _decision_ about what to
                   do with the mail is taken at phase _phase-name_ when
                   matching _conditions_.  Phases, matching conditions, and
                   decisions are described in “MAIL FILTERING”, below.
    
           **filter** _filter-name_ **proc** _proc-name_
                   Register "proc" filter _filter-name_ backed by the _proc-name_
                   process.
    
           **filter** _filter-name_ **proc-exec** _command_
                   Register and execute "proc" filter _filter-name_ from
                   _command_ , conformant with the _smtpd-filters_(7) API.  If
                   _command_ starts with a slash it is executed with an
                   absolute path, otherwise it will be run from
                   “/usr/local/libexec/smtpd/”.
    
           **include** "_pathname_ "
                   Replace this directive with the content of the additional
                   configuration file at the absolute _pathname_.
    
           **listen on** _interface_ [_family_] [_options_]
                   Listen on the _interface_ for incoming connections, using
                   the same syntax as _ifconfig_(8).  The _interface_ parameter
                   may also be an interface group, an IP address, or a domain
                   name.  Listening can optionally be restricted to a
                   specific address _family_ , which can be either **inet4** or
                   **inet6**.
    
                   The _options_ are as follows:
    
                   **auth**[<_authtable_ >]
                           Support SMTPAUTH: clients may only start SMTP
                           transactions after successful authentication.
                           Users are authenticated against either their own
                           normal login credentials or a credentials table
                           _authtable_ , the format of which is described in
                           _table_(5).
    
                   **auth-optional**[<_authtable_ >]
                           Support SMTPAUTH optionally: clients need not
                           authenticate, but may do so.  This allows a **listen**
                           **on** directive to both accept incoming mail from
                           untrusted senders and permit outgoing mail from
                           authenticated users (using **match auth**).  It can be
                           used in situations where it is not possible to
                           listen on a separate port (usually the submission
                           port, 587) for users to authenticate.
    
                   **ca** _caname_
                           For secure connections, use the CA certificate
                           associated with _caname_ (declared in a **ca**
                           directive) as the CA certificate when verifying
                           client certificates.
    
                   **filter** _name_
                           Apply filter _name_ on connections handled by this
                           listener.
    
                   **hostname** _hostname_
                           Use _hostname_ in the greeting banner instead of the
                           default server name.
    
                   **hostnames** <_names_ >
                           Override the server name for specific addresses.
                           The _names_ table contains a mapping of IP addresses
                           to hostnames.  If the address on which the
                           connection arrives appears in the mapping, the
                           associated hostname is used.
    
                   **mask-src**
                           Omit the **from** part when prepending “Received”
                           headers.
    
                   **no-dsn** Disable the DSN (Delivery Status Notification)
                           extension.
    
                   **pki** _pkiname_
                           For secure connections, use the certificate
                           associated with _pkiname_ (declared in a **pki**
                           directive) to prove a mail server's identity.
                           This option can be used multiple times to provide
                           alternate certificates for SNI.
    
                   **port**[_port_]
                           Listen on the given _port_ instead of the default
                           port 25.
    
                   **proxy-v2**
                           Support the PROXYv2 protocol, appropriately
                           rewriting the source address received from proxy.
    
                   **received-auth**
                           In “Received” headers, report whether the session
                           was authenticated and by which local user.
    
                   **senders** <_users_ > [**masquerade**]
                           Look up the authenticated user in the _users_
                           mapping table to find the email addresses that
                           user is allowed to submit mail as.  In addition,
                           if the **masquerade** option is provided, the From
                           header is rewritten to match the sender provided
                           in the SMTP session.
    
                   **smtps**[**verify**]
                           Support SMTPS, by default on port 465.  Mutually
                           exclusive with **tls**.  With the **verify** option,
                           clients must also provide a valid certificate to
                           establish an SMTP session.
    
                   **tag** _tag_
                           Clients connecting to the listener are tagged with
                           the given _tag_.
    
                   **tls** Support STARTTLS, by default on port 25.  Mutually
                           exclusive with **smtps**.
    
                   **tls-require**[**verify**]
                           Like **tls** , but force clients to establish a secure
                           connection before being allowed to start an SMTP
                           transaction.  With the **verify** option, clients must
                           also provide a valid certificate to establish an
                           SMTP session.
    
                   **protocols** _protostr_
                           Define the protocol versions to be used for TLS
                           sessions.  Refer to the
                           _tls_config_parse_protocols_(3) manpage for the
                           format of _protostr_.
    
                   **ciphers** _cipherstr_
                           Define the list of ciphers that may be used for
                           TLS sessions.  Refer to the
                           _tls_config_set_ciphers_(3) manpage for the format
                           of _cipherstr_.
    
           **listen on socket**[_options_]
                   Listen for incoming SMTP connections on the Unix domain
                   socket _/var/run/smtpd.sock_.  This is done by default, even
                   if the directive is absent.
    
                   The _options_ are as follows:
    
                   **filter** _name_
                           Apply filter _name_ on connections handled by this
                           listener.
    
                   **mask-src**
                           Omit the **from** part when prepending “Received”
                           headers.
    
                   **no-dsn** Disable the DSN (Delivery Status Notification)
                           extension.
    
                   **tag** _tag_
                           Clients connecting to the listener are tagged with
                           the given _tag_.
    
           **match** _options_ **action** _name_
                   If at least one mail envelope matches the _options_ of one
                   **match action** directive, receive the incoming message, put
                   a copy into each matching envelope, and atomically save
                   the envelopes to the mail spool for later processing by
                   the respective dispatcher _name_ which has to be declared
                   beforehand with the **action** directive.
    
                   The following matching options are supported and can all
                   be negated:
    
                   [**!**] **for any**
                           Specify that session may address any destination.
    
                   [**!**] **for local**
                           Specify that session may address any local domain.
                           This is the default, and may be omitted.
    
                   [**!**] **for domain**[**regex**] _domain_ | <_domain_ >
                           Specify that session may address the string or
                           list table _domain_.  The **regex** keyword is required
                           if _domain_ is a regular expression or table of
                           regular expressions.
    
                   [**!**] **for rcpt-to**[**regex**] _recipient_ | <_recipient_ >
                           Specify that session may address the string or
                           list table _recipient_.  The **regex** keyword is
                           required if _recipient_ is a regular expression or
                           table of regular expressions.
    
                   [**!**] **from any**
                           Specify that session may originate from any
                           source.
    
                   [**!**] **from auth**
                           Specify that session may originate from any
                           authenticated user, no matter the source IP
                           address.
    
                   [**!**] **from auth**[**regex**] _user_ | <_user_ >
                           Specify that session may originate from
                           authenticated user or user list _user_ , no matter
                           the source IP address.  The **regex** keyword is
                           required if _user_ is a regular expression or table
                           of regular expressions.
    
                   [**!**] **from local**
                           Specify that session may only originate from a
                           local IP address, or from the local enqueuer.
                           This is the default, and may be omitted.
    
                   [**!**] **from mail-from**[**regex**] _sender_ | <_sender_ >
                           Specify that session may originate from sender or
                           sender list _sender_ , no matter the source IP
                           address.  The **regex** keyword is required if _sender_
                           is a regular expression or table of regular
                           expressions.
    
                   [**!**] **from rdns**
                           Specify that session may only originate from an IP
                           address that resolves to a reverse DNS.
    
                   [**!**] **from rdns**[**regex**] _hostname_ | <_hostname_ >
                           Specify that session may only originate from an IP
                           address that resolves to a reverse DNS matching
                           string or list string _hostname_.  The **regex** keyword
                           is required if _hostname_ is a regular expression or
                           table of regular expressions.
    
                   [**!**] **from socket**
                           Specify that session may only originate from the
                           local enqueuer.
    
                   [**!**] **from src**[**regex**] _address_ | <_address_ >
                           Specify that session may only originate from
                           string or list table _address_ which can be a
                           specific address or a subnet expressed in CIDR-
                           notation.  The **regex** keyword is required if
                           _address_ is a regular expression or table of
                           regular expressions.
    
                   In addition, the following transaction options may be
                   matched:
    
                   [**!**] **auth**
                           Matches transactions which have been
                           authenticated.
    
                   [**!**] **auth**[**regex**] _username_ | <_username_ >
                           Matches transactions which have been authenticated
                           for user or user list _username_.  The **regex** keyword
                           is required if _username_ is a regular expression or
                           table of regular expressions.
    
                   [**!**] **helo**[**regex**] _helo-name_ | <_helo-name_ >
                           Specify that session's HELO / EHLO should match
                           the string or list table _helo-name_.  The **regex**
                           keyword is required if _helo-name_ is a regular
                           expression or table of regular expressions.
    
                   [**!**] **mail-from**[**regex**] _sender_ | <_sender_ >
                           Specify that transaction's MAIL FROM should match
                           the string or list table _sender_.  The **regex**
                           keyword is required if _sender_ is a regular
                           expression or table of regular expressions.
    
                   [**!**] **rcpt-to**[**regex**] _recipient_ | <_recipient_ >
                           Specify that transaction's RCPT TO should match
                           the string or list table _recipient_.  The **regex**
                           keyword is required if _recipient_ is a regular
                           expression or table of regular expressions.
    
                   [**!**] **tag**[**regex**] _tag_
                           Matches transactions tagged with the given _tag_.
                           The **regex** keyword is required if _tag_ is a regular
                           expression.
    
                   [**!**] **tls**
                           Specify that transaction should take place in a
                           TLS channel.
    
           **match** _options_ **reject**
                   Reject the incoming message during the SMTP dialogue.  The
                   same _options_ are supported as for the **match action**
                   directive.
    
           **mda wrapper** _name command_
                   Associate _command_ with the mail delivery agent wrapper
                   named _name_.  When a local delivery specifies a wrapper,
                   the _command_ associated with the wrapper will be executed
                   instead.  The command may contain format specifiers (see
                   “FORMAT SPECIFIERS”).
    
           **mta max-deferred** _number_
                   When delivery to a given host is suspended due to
                   temporary failures, cache at most _number_ envelopes for
                   that host such that they can be delivered as soon as
                   another delivery succeeds to that host.  The default is
                   100.
    
           **pki** _pkiname_ **cert** _certfile_
                   Associate certificate file _certfile_ with pki entry
                   _pkiname_.  The pki entry defines a keypair configuration
                   that can be referenced in listener rules and relay
                   actions.
    
                   A certificate chain may be created by appending one or
                   many certificates, including a Certificate Authority
                   certificate, to _certfile_.  The creation of certificates is
                   documented in _starttls_(8).
    
           **pki** _pkiname_ **key** _keyfile_
                   Associate the key located in _keyfile_ with pki entry
                   _pkiname_.
    
           **pki** _pkiname_ **dhe** _params_
                   Specify the DHE parameters to use for DHE cipher suites
                   with pki entry _pkiname_.  Valid parameter values are **none** ,
                   **legacy** , and **auto**.  For **legacy** , a fixed key length of 1024
                   bits is used, whereas for **auto** , the key length is
                   determined automatically.  The default is **none** , which
                   disables DHE cipher suites.
    
           **proc** _proc-name command_
                   Register an external process named _proc-name_ from _command_ ,
                   conformant with the _smtpd-filters_(7) API.  Such processes
                   may be used to share the same instance between multiple
                   filters.  If _command_ starts with a slash it is executed
                   with an absolute path, otherwise it will be run from
                   “/usr/local/libexec/smtpd/”.
    
           **queue compression**
                   Store queue files in a compressed format.  This may be
                   useful to save disk space.
    
           **queue encryption**[_key_]
                   Encrypt queue files with _EVP_aes_256_gcm_(3).  If no _key_ is
                   specified, it is read with _getpass_(3).  If the string
                   **stdin** or a single dash (‘-’) is given instead of a _key_ ,
                   the key is read from the standard input.
    
           **queue ttl** _delay_
                   Set the default expiration time for temporarily
                   undeliverable messages, given as a positive decimal
                   integer followed by a unit **s** , **m** , **h** , or **d**.  The default is
                   four days (4d).
    
           **smtp ciphers** _control_
                   Set the _control_ string for _SSL_CTX_set_cipher_list_(3).
                   The default is "HIGH:!aNULL:!MD5".
    
           **smtp limit max-mails** _count_
                   Limit the number of messages to _count_ for each session.
                   The default is 100.
    
           **smtp limit max-rcpt** _count_
                   Limit the number of recipients to _count_ for each
                   transaction.  The default is 1000.
    
           **smtp max-message-size** _size_
                   Reject messages larger than _size_ , given as a positive
                   number of bytes or as a string to be parsed with
                   _scan_scaled_(3).  The default is "35M".
    
           **smtp sub-addr-delim** _character_
                   When resolving the local part of a local email address,
                   ignore the ASCII _character_ and all characters following
                   it.  The default is ‘+’.
    
           **srs key**[**backup**] _secret_
                   Set the secret key to use for SRS, the Sender Rewriting
                   Scheme.  The **backup** option can be specified to set a
                   secret key to use as a fallback for SRS; this can be used
                   to implement SRS key rotation.
    
           **srs ttl** _delay_
                   Set the time-to-live delay for SRS envelopes.  After this
                   delay, a bounce reply to the SRS address will be discarded
                   to limit risks of forged addresses.  The default is four
                   days (4d).
    
           **table** _name_ [_type_ :]_pathname_
                   Tables provide additional configuration information for
                   _smtpd_(8) in the form of lists or key-value mappings.  The
                   format of the entries depends on what the table is used
                   for.  Refer to _table_(5) for the exhaustive documentation.
    
                   Each table is identified by an arbitrary, unique _name_.
    
                   If the _type_ is **db** , information is stored in a file created
                   with _makemap_(8); if it is **file** or omitted, information is
                   stored in a plain text file using the format described in
                   _table_(5).  The _pathname_ to the file must be absolute.
    
           **table** _name_ {_value_ [, _..._]}
                   Instead of using a separate file, declare a list table
                   containing the given static _value_ s.  The table must
                   contain at least one value and may declare multiple values
                   as a comma-separated (whitespace optional) list.
    
           **table** _name_ {_key_ =_value_ [, _..._]}
                   Instead of using a separate file, declare a mapping table
                   containing the given static _key_ -_value_ pairs.  The table
                   must contain at least one key-value pair and may declare
                   multiple pairs as a comma-separated (whitespace optional)
                   list.
    
       **MAIL FILTERING**
           In a regular workflow, _smtpd_(8) may accept or reject a message
           based only on the content of envelopes.  Its decisions are about
           the handling of the message, not about the handling of an active
           session.
    
           Filtering extends the decision making process by allowing _smtpd_(8)
           to stop at each phase of an SMTP session, check that conditions
           are met, then decide if a session is allowed to move forward.
    
           With filtering, a session may be interrupted at any phase before
           an envelope is complete.  A message may also be rejected after
           being submitted, regardless of whether the envelope was accepted
           or not.
    
           The following phases are currently supported:
    
                 connect      upon connection, before a banner is displayed
                 helo         after HELO command is submitted
                 ehlo         after EHLO command is submitted
                 mail-from    after MAIL FROM command is submitted
                 rcpt-to      after RCPT TO command is submitted
                 data         after DATA command is submitted
                 commit       after message is fully is submitted
    
           At each phase, various conditions may be matched.  The fcrdns,
           rdns, and src data are available in all phases, but other data
           must have been already submitted before they are available.
    
                 fcrdns                   forward-confirmed reverse DNS is
                                          valid
                 rdns                     session has a reverse DNS
                 rdns <_table_ >             session has a reverse DNS in table
                 src <_table_ >              source address is in table
                 helo <_table_ >             helo name is in table
                 auth                     session is authenticated
                 auth <_table_ >             session username is in table
                 mail-from <_table_ >        sender address is in table
                 rcpt-to <_table_ >          recipient address is in table
    
           These conditions may all be negated by prefixing them with an
           exclamation mark:
    
                 !fcrdns                  forward-confirmed reverse DNS is
                                          invalid
    
           Any conditions using a table may indicate that the table contains
           regular expressions by prefixing the table name with the keyword
           regex.
    
                 helo regex <_table_ >       helo name matches a regex in table
    
           Finally, a number of decisions may be taken:
    
                 bypass                   the session or transaction bypasses
                                          filters
                 disconnect _message_       the session is disconnected with
                                          message
                 junk                     the session or transaction is
                                          junked, i.e., an ‘X-Spam: yes’
                                          header is added to any messages
                 reject _message_           the command is rejected with
                                          message
                 rewrite _value_            the command parameter is rewritten
                                          with value
    
           Decisions that involve a message require that the message be RFC
           valid, meaning that they should either start with a 4xx or 5xx
           status code.  Decisions can be taken at any phase, though junking
           can only happen before a message is committed.
    
       **FORMAT SPECIFIERS**
           Some configuration directives support expansion of their
           parameters at runtime.  Such directives (for example **action**
           **maildir** , **action mda**) may use format specifiers which are expanded
           before delivery or relaying.  The following formats are currently
           supported:
    
                 %{sender}            sender email address, may be empty
                                      string
                 %{sender.user}       user part of the sender email address,
                                      may be empty
                 %{sender.domain}     domain part of the sender email
                                      address, may be empty
                 %{rcpt}              recipient email address
                 %{rcpt.user}         user part of the recipient email
                                      address
                 %{rcpt.domain}       domain part of the recipient email
                                      address
                 %{dest}              recipient email address after expansion
                 %{dest.user}         user part after expansion
                 %{dest.domain}       domain part after expansion
                 %{user.username}     local user
                 %{user.directory}    home directory of the local user
                 %{mbox.from}         name used in mbox From separator lines
                 %{mda}               mda command, only available for mda
                                      wrappers
    
           Expansion formats also support partial expansion using the
           optional bracket notations with substring offset.  For example,
           with recipient domain “example.org”:
    
                 %{rcpt.domain[0]}       expands to “e”
                 %{rcpt.domain[1]}       expands to “x”
                 %{rcpt.domain[8:]}      expands to “org”
                 %{rcpt.domain[-3:]}     expands to “org”
                 %{rcpt.domain[0:6]}     expands to “example”
                 %{rcpt.domain[0:-4]}    expands to “example”
    
           In addition, modifiers may be applied to the token.  For example,
           with recipient “User+Tag@Example.org”:
    
                 %{rcpt:lowercase}          expands to “user+tag@example.org”
                 %{rcpt:uppercase}          expands to “USER+TAG@EXAMPLE.ORG”
                 %{rcpt:strip}              expands to “User@Example.org”
                 %{rcpt:lowercase|strip}    expands to “user@example.org”
    
           For security concerns, expanded values are sanitized and
           potentially dangerous characters are replaced with ‘:’.  In
           situations where they are desirable, the “raw” modifier may be
           applied.  For example, with recipient “user+t?g@example.org”:
    
                 %{rcpt}        expands to “user+t:g@example.org”
                 %{rcpt:raw}    expands to “user+t?g@example.org”
    
       **MDA COMMANDS**
           When an action delivery method is **mda** , _smtpd_(8) runs the
           associated command for the delivery with the mail content provided
           via standard input.  The command is expected to read all the mail
           content.
    
           The exit code of the command reports the outcome of the delivery:
           status 0 (EX_OK) is a successful delivery; status 71 (EX_OSERR)
           and 75 (EX_TEMPFAIL) are temporary failures; and all other exit
           status are considered permanent failures.
    
           The following environment variables are set:
    
           DOMAIN              The recipient domain.
           EXTENSION           The sub address of the recipient (may be
                               unset).
           HOME                The delivery user's login directory.
           LOCAL               The local part of the recipient user address.
           LOGNAME             The login name of the user.
           ORIGINAL_RECIPIENT  The address of the original recipient.
           PATH                Set to _PATH_DEFPATH.  Traditionally
                               _/usr/bin:/bin_ , but expanded to include
                               _/usr/sbin_ , _/sbin_ , _/usr/X11R6/bin_ ,
                               _/usr/local/bin_ , and _/usr/local/sbin_ in
                               OpenBSD.
           RECIPIENT           The address of the final recipient.
           SENDER              The address of the sender (might be empty).
           SHELL               Set to _/bin/sh_.
           USER                Synonym of LOGNAME for backwards
                               compatibility.
    


## FILES



           _/etc/mail/smtpd.conf_     Default _smtpd_(8) configuration file.
           _/etc/mail/mailname_       If this file exists, the first line is
                                    used as the server name.  Otherwise, the
                                    server name is derived from the local
                                    hostname returned by _gethostname_(3),
                                    either directly if it is a fully
                                    qualified domain name, or by retrieving
                                    the associated canonical name through
                                    _getaddrinfo_(3).
           _/var/run/smtpd.sock_      Unix domain socket for incoming SMTP
                                    connections.
           _/var/spool/smtpd/_        Spool directories for mail during
                                    processing.
    


## EXAMPLES



           The default **smtpd.conf** file which ships with OpenBSD listens on
           the loopback network interface (_lo0_) and allows for mail from
           users and daemons on the local machine, as well as permitting
           email to remote servers.  Some more complex configurations are
           given below.
    
           This first example is similar to the default configuration, but
           all outgoing mail is forwarded to a remote SMTP server.  A secrets
           file is needed to specify a username and password:
    
                 # touch /etc/mail/secrets
                 # chmod 640 /etc/mail/secrets
                 # chown root:_smtpd /etc/mail/secrets
                 # echo "bob username:password" > /etc/mail/secrets
    
           **smtpd.conf** would look like this:
    
                 table aliases file:/etc/mail/aliases
                 table secrets file:/etc/mail/secrets
    
                 listen on lo0
    
                 action "local_mail" mbox alias <aliases>
                 action "outbound" relay host smtp+tls://bob@smtp.example.com \
                         auth <secrets>
    
                 match from local for local action "local_mail"
                 match from local for any action "outbound"
    
           In this second example, the aim is to permit mail delivery and
           relaying only for users that can authenticate (using their normal
           login credentials).  An RSA certificate must be provided to prove
           the server's identity.  The mail server listens on all interfaces
           the default routes point to.  Mail with a local destination is
           sent to an external MDA.  First, the RSA certificate is created:
    
                 # openssl genrsa -out /etc/ssl/private/mail.example.com.key 4096
                 # openssl req -new -x509 -key /etc/ssl/private/mail.example.com.key \
                         -out /etc/ssl/mail.example.com.crt -days 365
                 # chmod 600 /etc/ssl/mail.example.com.crt
                 # chmod 600 /etc/ssl/private/mail.example.com.key
    
           In the example above, a certificate valid for one year was
           created.  The configuration file would look like this:
    
                 pki mail.example.com cert "/etc/ssl/mail.example.com.crt"
                 pki mail.example.com key "/etc/ssl/private/mail.example.com.key"
    
                 table aliases file:/etc/mail/aliases
    
                 listen on lo0
                 listen on egress tls pki mail.example.com auth
    
                 action mda_with_aliases mda "/path/to/mda -f -" alias <aliases>
                 action mda_without_aliases mda "/path/to/mda -f -"
                 action "outbound" relay
    
                 match for local action mda_with_aliases
                 match from any for domain example.com action mda_without_aliases
                 match for any action "outbound"
                 match auth from any for any action "outbound"
    
           For sites that wish to sign messages using DKIM, the following
           example uses **opensmtpd-filter-dkimsign** for DKIM signing:
    
                 table aliases file:/etc/mail/aliases
    
                 filter "dkimsign" proc-exec "filter-dkimsign -d <domain> -s <selector> \
                         -k /etc/mail/dkim/private.key" user _dkimsign group _dkimsign
    
                 listen on socket filter "dkimsign"
                 listen on lo0 filter "dkimsign"
    
                 action "local_mail" mbox alias <aliases>
                 action "outbound" relay
    
                 match for local action "local_mail"
                 match for any action "outbound"
    
           Alternatively, the **opensmtpd-filter-rspamd** package may be used to
           provide integration with **rspamd** , a third-party daemon which
           provides multiple antispam features as well as DKIM signing.  As
           well as configuring **rspamd** itself, it requires use of the
           **proc-exec** keyword:
    
                 filter "rspamd" proc-exec "filter-rspamd"
    
           Sites that accept non-local messages may be able to cut down on
           the volume of spam received by rejecting forged messages that
           claim to be from the local domain.  The following example uses a
           list table _other-relays_ to specify the IP addresses of relays that
           may legitimately originate mail with the owner's domain as the
           sender.
    
                 table aliases file:/etc/mail/aliases
                 table other-relays file:/etc/mail/other-relays
    
                 listen on lo0
                 listen on egress
    
                 action "local_mail" mbox alias <aliases>
                 action "outbound" relay
    
                 match for local action "local_mail"
                 match for any action "outbound"
                 match !from src <other-relays> mail-from "@example.com" for any \
                       reject
                 match from any for domain example.com action "local_mail"
    


* * *