Qsmtpd(8)

NAME
Qsmtpd - receive mail via (E)SMTP

SYNOPSIS
Qsmtpd [ hostname checkprogram subprogram ]

DESCRIPTION
Qsmtpd behaves more or less like qmail-smtpd(8) , but adds better spam filtering capabilities, better RfC compliance, IPv6 support and more SMTP extensions out-of-the-box. Qsmtpd receives mail messages via the Simple Mail Transfer Protocol (SMTP) and invokes qmail-queue to deposit them into the outgoing queue. Qsmtpd must be supplied several environment variables; see tcp-environ(5). Qsmtpd accepts messages sent as SMTP or ESMTP. The extensions ENHANCEDSTATUSCODES, PIPELINING, 8BITMIME and SIZE are always announced in ESMTP mode. CHUNKING is also announced if it has been enabled at compile time. If hostname , checkprogram and subprogram arguments are present and checkprogram exists the AUTH extension is announced. If a TLS certificate is present the STARTTLS extension is also announced. Qsmtpd counts the number of Recevied:-lines in the mail header. It rejects any message with 100 or more Received: header fields. Qsmtpd can accept LOGIN, PLAIN, and CRAM-MD5 AUTH types. They can be limited using the authtypes file. It invokes checkprogram, which reads on file descriptor 3 the username, a 0 byte, the password or challenge derived from hostname, another 0 byte, a CRAM-MD5 response (if applicable to the AUTH type), and a final 0 byte. checkprogram invokes subprogram upon successful authentication, which should in turn return 0 to Qsmtpd. Qsmtpd will reject the authentication attempt if it receives a nonzero return value from checkprogram or subprogram.

TRANSPARENCY
Qsmtpd converts the SMTP newline convention into the UNIX newline convention by converting CR LF into LF. It returns a permanent error on bare CRs or LFs as well as lines with more than 1000 characters. Messages that contain non-ASCII characters are rejected if the client announced the message to be pure ASCII or if the connection is not in ESMTP mode.

RECIPIENTS
Qsmtpd tries to figure out if local recipients or sender addresses exist. All addresses that fail this check will be rejected. These tests only work for virtual domains (e.g. created by vpopmail), local users will not be checked.

CONTROL FILES
These files are used for configuring several aspects of Qsmtpd if the domain is controlled by vpopmail. In this case the more local file overrides the global files. Only files marked with (user) can be used in user or domain directories.

authtypes
    A list of all auth types that should be announced. Empty lines and lines beginning with # are ignored.

badmailfrom
    (user) Unacceptable envelope sender addresses. Qsmtpd will reject every recipient address for a message if the envelope sender address is listed in badmailfrom. A line in badmailfrom may be of the form @host, meaning every address at host. If an entry does not contain a '@' the domain and all subdomains are rejected.
            example.com
    would block emails from *@example.com as well as *@*.example.com. In contrast if the entry does not contain a '@' and begins with '.' only subdomains will be blocked:
            .example.org
    would block emails from *@*.example.org, but *@example.org would pass.

badcc
    (user) Unacceptable CC addresses. Qsmtpd will reject mails where a recipient address that matches an expression in this file is already present. The format of the file is the same as for badmailfrom.

clientca.pem
    A list of Certifying Authority (CA) certificates that are used to verify the client-presented certificates during a TLS-encrypted session.

databytes
    Maximum number of bytes allowed in a message, or 0 for no limit. Default: 0. If a message exceeds this limit, Qsmtpd returns a permanent error code to the client; in contrast, if the disk is full or Qsmtpd hits a resource limit, a temporary error code is retuned. databytes counts bytes as stored on disk, not as transmitted through the network. It does not count the Qsmtpd Received line, the qmail-queue Received line, or the envelope.

localiphost
    Replacement host name for local IP addresses. Default: me, if that is supplied. Qsmtpd is responsible for recognizing dotted-decimal addresses for the current host. When it sees a recipient address of the form box@[d.d.d.d], where d.d.d.d is a local IP address, it replaces [d.d.d.d] with localiphost. This is done before rcpthosts.

rcpthosts
    Allowed RCPT domains. If rcpthosts is supplied, Qsmtpd will reject any envelope recipient address with a domain not listed in rcpthosts. rcpthosts may include wildcards:
           example.org
           .example.com
    The only allowed envelope recipient address without @ sign is postmaster.

dh2048.pem
    If this 2048 bit Diffie Hellman group is provided, Qsmtpd will use it for TLS sessions instead of generaring one on-the-fly.

rsa2048.pem
    If this 2048 bit RSA key is provided, Qsmtpd will use it for TLS sessions instead of generaring one on-the-fly.

servercert.pem.a.a.a.a:b
    SSL certificate specific to the IP a.a.a.a and the port b the server is listening on. See servercert.pem. The address must be in dotted decimal form for IPv4 addresses and in the default IPv6 format (no leading zeroes, :: abbreviation) for IPv6 addresses.

servercert.pem.a.a.a.a
    SSL certificate specific to the IP the server is listening on. See servercert.pem. The address must be in dotted decimal form for IPv4 addresses and in the default IPv6 format (no leading zeroes, :: abbreviation) for IPv6 addresses.

servercert.pem
    SSL certificate to be presented to clients in TLS-encrypted sessions. Certifying Authority (CA) and intermediate certificates can be added at the end of the file. Only loaded if no IP-specific certificate file exists.

timeoutsmtpd
    Number of seconds Qsmtpd will wait for each new buffer of data from the remote SMTP client. Default: 1200.

tlsclients
    A list of email addresses. When relay rules would reject an incoming message, Qsmtpd can allow it if the client presents a certificate that can be verified against the CA list in clientca.pem and the certificate email address is in tlsclients.

tlsserverciphers
    A set of OpenSSL cipher strings. Multiple ciphers contained in a string should be separated by a colon. If the environment variable TLSCIPHERS is set to such a string, it takes precedence.

filterconf
    (user) Configures several binary or integer settings. See filterconf(5).

forcesslauth
    If file contents is a number and not 0, AUTH extension will only be announced if STARTTLS has been sent by client before and succeeded.

vpopbounce
    A .qmail-default file with the same contents as this file will be used as sign that this recipient does not exist. Normally vadddomain(5)

rspf
    (user) If a domain does not specify a SPF record check for TXT records for this remote SPF lists. MAIL FROM:<foo@example.com> and a rspf containing the line
           rspf.example.org
    would cause a DNS TXT lookup for example.com.rspf.example.org. If this query returns a valid SPF string this will be taken as if example.com had this entry itself.

spfstrict
    (user) List of domains where every mail not explicitely allowed by SPF will be rejected. This means if the domain has a SPF entry ending with "~all" the mail will be blocked.

spfignore
    (user) List of hosts that are known to forward mail to us. Mails from this host will never be blocked because of SPF entries.

spffriends
    Holds a list of IPv4 addresses where no SPF checks will be done at all, neither there will be a Received-SPF:-line. Every address is followed by a netmask length specifying if a whole network is allowed to relay. Use the addipbl command to add new entries to this file. Matches in this file will override spfstrict.

spffriends6
    Works the same as spffriends, but for IPv6 addresses.

wildcardns
    A list of top level domains and their wildcard NS entries. Format is "TLD_IPv6address", where TLD is the name of the top level domain (without leading dot) and IPv6address is an IPv6 literal. There are no spaces allowed anywhere in a line containing an entry, but normal comments (lines beginning with #, empty lines) are allowed. If a TLD has multiple wildcard entries use multiple lines with the same TLD name and one entry each.

authhide
    If this file contains a positive integer number the name and IP address of the sending host will not be written to the Received: line in the mail body if the client is authenticated. Use this if your users want some extra privacy.

nomail
    (user) Reject all mail to this user with the given message. If the file exists but is empty a general rejection message will be announced. The message may start with a rejection code like:
        550 5.7.1
    The rejection code must be of the form given in the example. The first digit of both blocks must match, all other digits may be of any value. The two blocks must be separated by exactly one space. After the second block must be at least one more space. If the code does not match this requirements or is not found at all the code given in the example will be used. The rejection line may be of any length, the message will be folded if necessary. The file may contain comments, but only one valid line.

relayclients
    Holds a list of IPv4 addresses allowed for relaying. Every address is followed by a netmask length specifying if a whole network is allowed to relay. Use the addipbl command to add new entries to this file.

relayclients6
    Works the same as relayclients, but for IPv6 addresses.

RELAYING
By default Qsmtpd does not allow relaying. Contrary to qmail-smtpd it will not look at the RELAYCLIENT environment variable. Relaying is permitted in one of two cases: the user has authenticated himself using SMTP AUTH or a SSL client certificate, or the IP address of the client is found in one of the relayclients or relayclients6 control files (see above).

DEBUGGING
If Qsmtpd has been with the DEBUG_IO flag the contents of the SMTP transmissions can be recorded. They will be sent to the syslog daemon with facility mail and log level debug. The contents of the SMTP DATA phase will never be logged for privacy reasons. Logging is not enabled by default. If Qsmtpd finds an environment variable QSMTPD_DEBUG with a non-empty value or a file control/Qsmtpd_debug is readable on startup it will log. Therefore it will usually not harm to compile that facility into the program.

SEE ALSO
tcp-env(1), filterconf(5), tcp-environ(5), qmail-control(5), qmail-inject(8), qmail-queue(8), qmail-smtpd(8)

AUTHOR
Rolf Eike Beer

WEBSITE
https://opensource.sf-tec.de/Qsmtp/