PowerMTA configuration example

Mandatory TLS partner route

Require TLS only for an explicitly controlled partner destination.

This is a teaching baseline, not a drop-in universal production configuration. Replace all example values and test with your installed release.

Configuration

# Mandatory TLS partner route
# Review every address, hostname, credential and path before use.
host-name pmta1.example.com
postmaster [email protected]

<virtual-mta vmta-13>
    smtp-source-host 192.0.2.23 mail13.example.com
</virtual-mta>

<domain *>
    max-smtp-out 2
    max-msg-per-connection 20
    retry-after 15m
    bounce-after 4d
</domain>

Deployment checklist

Replace documentation IP addresses and domains.
Confirm PTR, forward DNS, SPF, DKIM, DMARC, and Return-Path alignment.
Validate object names and included files.
Start with low traffic and review responses by provider.
Keep credentials outside publicly readable files and rotate them periodically.

What to monitor

Queue age and destination backlog.
Temporary versus permanent response rates.
Connection failures, TLS negotiation, and authentication errors.
Complaint, bounce, and suppression events.