Powermta Configuration Guide Top ⇒

queue-mem-pool-size 2048M large-message-threshold 262144 # 256KB Assign specific CPU cores to specific domains to prevent cross-domain blocking.

# Fallback for subdomains dkim-signer * dkim-default /etc/pmta/dkim/default.key </domain> To track which recipient bounced, use Variable Envelope Return Path (VERP). powermta configuration guide top

<virtual-mta warmup> <source 203.0.113.30> max-smtp-out 1 max-message-rate 100/h auto-fast-flush no <limit> max-recipients-per-connection 5 </limit> </source> </virtual-mta> PowerMTA cannot fix broken DNS, but it can enforce signing. The top misconfiguration is forgetting that DKIM signing must match the d= domain . Dynamic DKIM Signing <domain *> # Use an external signer or internal sign-dkim yes dkim-signature-fields "From:To:Subject:Date" # Map sender domain to selector dkim-signer @mydomain.com dkim-selector1 mydomain.com:/etc/pmta/dkim/private.key The top misconfiguration is forgetting that DKIM signing

<domain *> retry-after "4xx" 900 # Wait 15 min on temp fail retry-after "450" 3600 # Wait 1 hour on mailbox busy # Exponential backoff retry-scheme linear retry-interval 600,1200,1800,3600 </domain> Many hacked PowerMTA instances are used for spam because relaying is open. Lock it down. not on a timer. &lt

<virtual-mta transactional> group-id 100 <source 203.0.113.10> auto-fast-flush no process-x-header Yes </source> </virtual-mta> <virtual-mta marketing> group-id 200 <source 203.0.113.20> smtp-service fast-flush-delay 2 </source> </virtual-mta> Google (Gmail) and Microsoft (Outlook/Hotmail) have strict acceptance rates. You must throttle.

<domain *> bounce-verp-address "bounce+$r@bounces.mydomain.com" bounce-verp-pattern "$r+$h@bounces.mydomain.com" # Critical: Only VERP for hard bounces to save resources bounce-verp-on-hard yes bounce-verp-on-delay no </domain> These parameters directly control throughput. Copy these into your pmta.conf for immediate gains. Connection & Concurrency | Parameter | Recommended Value | Why | | :--- | :--- | :--- | | max-smtp-out | 30 (Global), 2-20 (per domain) | Prevents local resource exhaustion | | smtp-out-connection-timeout | 60s | Drop dead connections fast | | smtp-out-data-timeout | 180s | Allow large attachments but don't wait forever | | queue-sync-interval | 10 | Flush metadata to disk frequently | | max-recipients-per-message | 100 | Avoids fragmentation on big ESPs | Fast Flush (Instant Delivery) Fast flush sends messages the moment they enter the queue, not on a timer.

<source 127.0.0.1> allow-relay yes </source>