All help articles

Sending through us from your own mail server

Your own mail servers (Exim, Postfix, Microsoft Exchange, Sendmail) and devices that send mail (a web server, a scanner, a NAS) can send their outgoing mail through us, as a smarthost. Their mail then leaves from our servers: signed with your domain's DKIM key, checked for viruses and spam like the mail your users send, and within your plan's sending limits. Receivers see SPF, DKIM and DMARC pass for your domain, as they do for mail sent from webmail.

This needs a plan that includes Smarthost relay. Only the tenant's owners and admins set it up.

Making a relay credential

In the tenant manager, under Mail → Sending from your own mail servers (smarthost), choose New relay credential:

• Name: what it is for, such as "Office Exim".
• Signs in as: one of your mailboxes. Its address is the user name the server signs in with. That mailbox's plan limits, suspension, spam complaints and archive apply to everything the server sends, so a mailbox of its own (such as relay@example.com) is clearest.
• May send as any address on: one or more of your domains. Only proved domains can be chosen, and never the platform's shared domains.
• Only from these addresses or networks: your server's public address (such as 198.51.100.7) or network, one a line, no wider than /16 for IPv4 or /32 for IPv6. Leave it empty to allow anywhere, but setting it is strongly advised: then a stolen secret is no use from elsewhere.
• Recipients an hour and a day: caps of the credential's own, on top of the mailbox's plan limits. Leave them empty for the plan's only.

Make credential shows the secret, the password your server signs in with, once, with settings for Exim and Postfix. Copy it then. New secret replaces it later, and the old one stops working at once.

What the server may send

• Any address on the credential's domains, in the envelope (MAIL FROM) and in From, Sender, Resent-From and Resent-Sender, so your server can send for all its users and for cron@, noreply@ and the like.
• Bounces, with an empty envelope sender (MAIL FROM:<>). Their From must be on the credential's domains too: set your server's bounce address (such as MAILER-DAEMON@example.com) to one of them.
• Never another domain, including a subdomain you have not added and proved, another customer's domain or the platform's own. Mail that tries is refused. A name in From that shows an address on another domain is refused too.

A domain that moves to another tenant, or stops being proved, stops being relayed at once. Everything else that applies to mail your users send applies here too: risky attachments, virus scanning, your sending limits, outgoing spam checks, suspensions and the message trace. A trace shows the credential's name.

Server settings

Every server needs the same four things:

Always use TLS. Port 25 does not take relayed mail.

Exim (Debian and Ubuntu)

Run dpkg-reconfigure exim4-config and choose "mail sent by smarthost; received via SMTP or fetchmail". Give the smarthost as HOST::587 (two colons before the port), or set it in /etc/exim4/update-exim4.conf.conf:

dc_eximconfig_configtype='smarthost'
dc_smarthost='HOST::587'

Put the user name and secret in /etc/exim4/passwd.client:

HOST:relay@example.com:cs_sh_...

Then run update-exim4.conf and systemctl restart exim4. To keep the secret readable only by Exim: chown root:Debian-exim /etc/exim4/passwd.client and chmod 640 /etc/exim4/passwd.client.

Exim (any system, its own configuration)

In the routers section, before the dnslookup router:

smarthost:
  driver = manualroute
  domains = ! +local_domains
  transport = smarthost_smtp
  route_list = * HOST::587 byname
  no_more

In the transports section:

smarthost_smtp:
  driver = smtp
  port = 587
  hosts_require_auth = *
  hosts_require_tls = *

In the authenticators section:

plain_login:
  driver = plaintext
  public_name = PLAIN
  client_send = ^relay@example.com^cs_sh_...

Set qualify_domain (and the bounce sender) to one of the credential's domains, so mail from local users without a domain gets one we relay.

Postfix

In /etc/postfix/main.cf:

relayhost = [HOST]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt

In /etc/postfix/sasl_passwd:

[HOST]:587 relay@example.com:cs_sh_...

Then chmod 600 /etc/postfix/sasl_passwd, postmap /etc/postfix/sasl_passwd and systemctl reload postfix. Set myorigin to one of the credential's domains.

Microsoft Exchange

Make a send connector (Exchange admin center → Mail flow → Send connectors) for the address space *, routing through a smart host: your mail server's host name. Choose Basic authentication over TLS with the user name and secret, and port 587 (Set-SendConnector -Port 587).

Sendmail

In sendmail.mc, define(SMART_HOST', [HOST]')dnl and define(RELAY_MAILER_ARGS', TCP $h 587')dnl, with AuthInfo:HOST "U:relay@example.com" "P:cs_sh_..." "M:PLAIN" in /etc/mail/authinfo. Rebuild the configuration and restart Sendmail.

Devices and applications

A scanner, a NAS, a web application or a script takes the same server, port, user name and password in its "SMTP server" settings. Choose STARTTLS (587) or SSL/TLS (465). For a device that cannot send as many addresses, an app password of its own mailbox is simpler.

When something is refused

• 535 authentication failed: the user name, or the secret, is wrong; the credential is switched off or removed; your server's address is not in its networks; or your plan no longer includes the relay.
• 550 not your address: the envelope sender or a From, Sender or name in them is not on the credential's domains.
• Limit reached: the credential's own cap, or the mailbox's plan limit, for the hour or the day.

Every message, refused or not, is in the message trace.

From the API and command line

The tenant's owners and admins use GET and POST /v1/tenants/{tenantId}/smarthosts, PATCH and DELETE /v1/tenants/{tenantId}/smarthosts/{smarthostId}, and POST .../{smarthostId}/secret for a new secret. A key limited to some of the tenant's domains cannot use them.