SMTPD.CONF(5) File Formats Manual SMTPD.CONF(5) (NAME) smtpd.conf - SMTP (DESCRIPTION) smtpd.conf smtpd(8) . "RCPT TO:" (envelope) . ( match) . ( action) . . . . (`\') . (`#') . : . ( listen, match, port) . (") . name=value . name . $name value . : lan_addr = "192.168.0.1" listen on $lan_addr listen on $lan_addr tls auth smtpd.conf . action name method [options] action name match ... action . action . . action smtpd(8) name . method : expand-only .forward . forward-only forward . lmtp destination [rcpt-to] LMTP destination . host:port . rcpt-to ( ) LMTP RCPT TO . maildir [pathname] [junk] maildir pathname ( ) ~/Maildir . pathname ( FORMAT SPECIFIERS). junk `X-Spam' `Junk' . pathname . mbox mail.local(8) mbox . mda command command ( MDA COMMANDS). command ( FORMAT SPECIFIERS). relay SMTP . : alias table aliases(5) . ttl n{s|m|h|d} . user username username getpwnam(3) . . mbox . .forward . userbase
table getpwnam(3) . userbase user . virtual
table . table(5) . wrapper name (wrapper) mda wrapper . (relay) : backup . backup mx name name . ca caname caname ( ca ) . helo heloname heloname HELO . helo-src
table HELO . domain MX domains relay url . host relay-url MX relay-url . relay-url : [proto://[label@]]host[:port]. : smtp SMTP STARTTLS (). smtp+tls SMTP STARTTLS . smtp+notls SMTP TLS. lmtp LMTP. port . smtps SMTP TLS . . port . label table(5) . "smtp+tls" "smtps" . . pki pkiname pkiname ( pki ) . srs (Sender Rewriting Scheme) . tls [no-verify] TLS STARTTLS . (smarthost) "smtp+notls://" . no-verify . protocols protostr TLS . protostr tls_config_parse_protocols(3) . ciphers cipherstr TLS . cipherstr tls_config_set_ciphers(3) . auth
table relay-url . host . table(5) . mail-from mailaddr mailaddr MAIL FROM SMTP . src sourceaddr | sourceaddr IP . . admd authservid (Administrative Management Domain) . authservid authentication-results . . bounce warn-interval delay [, delay ...] delay . delay s, m, h, d . delay . "bounce warn-interval 4h" . ca caname cert cafile (CA) cafile ca caname . ca listen on action ... relay . filter chain-name chain {filter-name [, ...]} chain-name filter-name . . . filter filter-name phase phase-name match conditions decision filter-name . decision phase-name conditions . MAIL FILTERING . filter filter-name proc proc-name "proc" filter-name proc-name . filter filter-name proc-exec command "proc" filter-name command API smtpd-filters(7) . command "/usr/lib/smtpd/opensmtpd" . include "pathname" pathname . listen on interface [family] [options] interface ifconfig(8) . interface IP . family inet4 inet6 . options : auth [] SMTPAUTH : SMTP . authtable table(5) . auth-optional [] SMTPAUTH : . listen on ( match auth). ( submission ) . ca caname CA caname ( ca) CA . filter name name . hostname hostname hostname . hostnames . names IP . . mask-src from "Received" . no-dsn DSN ( ) . pki pkiname pkiname ( pki) . SNI . port [port] port . proxy-v2 PROXYv2 . received-auth "Received " . senders [masquerade] users . masquerade From SMTP . smtps [verify] SMTPS . tls . verify SMTP . tag tag tag . tls STARTTLS . smtps . tls-require [verify] tls SMTP . verify SMTP . protocols protostr TLS . protostr tls_config_parse_protocols(3) . ciphers cipherstr TLS . cipherstr tls_config_set_ciphers(3) . listen on socket [options] SMTP /run/smtpd.sock . . options : filter name name . mask-src from "Received" . no-dsn DSN ( ) . tag tag tag . match options action name options match action name ( action ) . ( !) : [!] for any . [!] for local . . [!] for domain [regex] domain | domain . regex domain . [!] for rcpt-to [regex] recipient | recipient . regex recipient . [!] from any . [!] from auth IP . [!] from auth [regex] user | user IP . regex user . [!] from local IP (local enqueuer) . . [!] from mail-from [regex] sender | sender IP . regex sender . [!] from rdns IP reverse DNS . [!] from rdns [regex] hostname | IP reverse DNS hostname . regex hostname . [!] from socket . [!] from src [regex] address |
address CIDR . regex address . : [!] auth . [!] auth [regex] username | username . regex username . [!] helo [regex] helo-name | HELO / EHLO helo-name . regex helo-name . [!] mail-from [regex] sender | MAIL FROM sender . regex sender . [!] rcpt-to [regex] recipient | RCPT TO recipient . regex recipient . [!] tag [regex] tag tag . regex tag . [!] tls TLS . match options reject SMTP . options match action . mda wrapper name command command name . command . ( FORMAT SPECIFIERS). mta max-deferred number number () . . pki pkiname cert certfile certfile pki pkiname . pki . (CA) certfile . starttls(8) . pki pkiname key keyfile keyfile pki pkiname . pki pkiname dhe params DHE DHE pki pkiname . none, legacy, auto. legacy auto . none DHE . proc proc-name command proc-name command API smtpd-filters(7) . . command "/usr/lib/smtpd/opensmtpd" . queue compression . . queue encryption [key] EVP_aes_256_gcm(3) . key getpass(3) . key stdin (`-') . queue ttl delay s, m, h, d . (4d) . smtp ciphers control control SSL_CTX_set_cipher_list(3) . "HIGH:!aNULL:!MD5" . smtp limit max-mails count count . . smtp limit max-rcpt count count . . smtp max-message-size size size scan_scaled(3) . "35M" . smtp sub-addr-delim character character . `+' . srs key [backup] secret SRS ( ) . backup SRS SRS . srs ttl delay (TTL) SRS . (bounce) SRS . (4d) . table name [type:]pathname smtpd(8) - . . table(5) . name . type db makemap(8) file table(5) . pathname . table name {value [, ...]} values . ( ) . table name {key=value [, ...]} key-value . - ( ) . (MAIL FILTERING) smtpd(8) . . smtpd(8) SMTP . . . : connect helo HELO ehlo EHLO mail-from MAIL FROM rcpt-to RCPT TO data DATA commit . fcrdns rdns src . fcrdns DNS rdns DNS rdns
DNS src
helo
helo auth auth
mail-from
rcpt-to
: !fcrdns DNS regex . helo regex
helo regex : bypass disconnect message junk `X-Spam: yes' reject message rewrite value RFC 4xx 5xx . (junk) . (FORMAT SPECIFIERS) . ( action maildir, action mda) . : %{sender} %{sender.user} %{sender.domain} %{rcpt} %{rcpt.user} %{rcpt.domain} %{dest} %{dest.user} %{dest.domain} %{user.username} %{user.directory} %{mbox.from} From mbox %{mda} mda mda . "example.org": %{rcpt.domain[0]} "e " %{rcpt.domain[1]} "x " %{rcpt.domain[8:]} "org " %{rcpt.domain[-3:]} "org " %{rcpt.domain[0:6]} "example " %{rcpt.domain[0:-4]} "example " . "User+Tag@Example.org": %{rcpt:lowercase} "user+tag@example.org " %{rcpt:uppercase} "USER+TAG@EXAMPLE.ORG " %{rcpt:strip} "User@Example.org " %{rcpt:lowercase|strip} "user@example.org " `:' . "raw" . "user+t?g@example.org": %{rcpt} "user+t:g@example.org " %{rcpt:raw} "user+t?g@example.org " (MDA COMMANDS) mda smtpd(8) . . : 0 (EX_OK) 71 (EX_OSERR) 75 (EX_TEMPFAIL) . : DOMAIN . EXTENSION (). HOME . LOCAL . LOGNAME . ORIGINAL_RECIPIENT . PATH _PATH_DEFPATH. /usr/bin:/bin /usr/sbin /sbin /usr/X11R6/bin /usr/local/bin /usr/local/sbin OpenBSD. RECIPIENT . SENDER (). SHELL /bin/sh. USER LOGNAME . (FILES) /etc/smtpd/smtpd.conf smtpd(8). /etc/smtpd/mailname . gethostname(3) getaddrinfo(3). /run/smtpd.sock SMTP. /var/spool/smtpd/ . (EXAMPLES) smtpd.conf OpenBSD loopback (lo0) . . SMTP . (secrets) : # touch /etc/smtpd/secrets # chmod 640 /etc/smtpd/secrets # chown root:smtpd /etc/smtpd/secrets # echo "bob username:password" > /etc/smtpd/secrets smtpd.conf : table aliases file:/etc/smtpd/aliases table secrets file:/etc/smtpd/secrets listen on lo0 action "local_mail" mbox alias action "outbound" relay host smtp+tls://bob@smtp.example.com \ auth match from local for local action "local_mail" match from local for any action "outbound" ( ). RSA . . MDA . RSA : # openssl genrsa -out /etc/ssl/private/mail.example.com.key 4096 # openssl req -new -x509 -key /etc/ssl/private/mail.example.com.key \ -out /etc/ssl/mail.example.com.crt -days 365 # chmod 600 /etc/ssl/mail.example.com.crt # chmod 600 /etc/ssl/private/mail.example.com.key . : pki mail.example.com cert "/etc/ssl/mail.example.com.crt" pki mail.example.com key "/etc/ssl/private/mail.example.com.key" table aliases file:/etc/smtpd/aliases listen on lo0 listen on egress tls pki mail.example.com auth action mda_with_aliases mda "/path/to/mda -f -" alias action mda_without_aliases mda "/path/to/mda -f -" action "outbound" relay match for local action mda_with_aliases match from any for domain example.com action mda_without_aliases match for any action "outbound" match auth from any for any action "outbound" DKIM opensmtpd-filter-dkimsign DKIM : table aliases file:/etc/smtpd/aliases filter "dkimsign" proc-exec "filter-dkimsign -d -s \ -k /etc/smtpd/dkim/private.key" user _dkimsign group _dkimsign listen on socket filter "dkimsign" listen on lo0 filter "dkimsign" action "local_mail" mbox alias action "outbound" relay match for local action "local_mail" match for any action "outbound" opensmtpd-filter-rspamd rspamd DKIM . rspamd proc-exec : filter "rspamd" proc-exec "filter-rspamd" . other-relays IP . table aliases file:/etc/smtpd/aliases table other-relays file:/etc/smtpd/other-relays listen on lo0 listen on egress action "local_mail" mbox alias action "outbound" relay match for local action "local_mail" match for any action "outbound" match !from src mail-from "@example.com" for any \ reject match from any for domain example.com action "local_mail" (SEE ALSO) mailer.conf(5), table(5), smtpd-filters(7), makemap(8), smtpd(8) (HISTORY) smtpd(8) OpenBSD 4.6 . Linux 6.12.107+deb13-amd64 August 26, 2025 Linux 6.12.107+deb13-amd64