1MTA-STS-DAEMON.YML(5)         mta-sts-daemon.yml         MTA-STS-DAEMON.YML(5)
2
3
4

NAME

6       mta-sts-daemon.yml - configuration file for mta-sts-daemon
7

DESCRIPTION

9       This configuration file configures the listening socket, caching
10       behaviour, and manipulation of MTA-STS mode.
11

SYNTAX

13       The file is in YAML syntax with the following elements:
14
15       host: (str) daemon bind address. Default: 127.0.0.1
16
17       port: (int) daemon bind port. Default: 8461
18
19       path: (str) daemon UNIX socket bind address (path). If specified, host
20       and port are ignored and UNIX socket is bound instead of TCP.
21
22       mode: (int) file mode for daemon UNIX socket. If not specified default
23       filemode is used. This option has effect only when UNIX socket is used.
24       If file mode specified in octal form (most common case), it has to be
25       prepended with leading zero. Example: 0666
26
27       reuse_port: (bool) allow multiple instances to share same port
28       (available on Unix, Windows). Default: true
29
30       cache_grace: (float) age of cache entries in seconds which do not
31       require policy refresh and update. Default: 60
32
33       shutdown_timeout: (float) time limit granted to existing client
34       sessions for finishing when server stops. Default: 20
35
36       cache
37
38           •   type: (str: internal|sqlite|redis) cache backend type. Default:
39               internal
40
41           •   options:
42
43               •   Options for internal type:
44
45                   •   cache_size: (int) number of cache entries to store in
46                       memory. Default: 10000
47
48               •   Options for sqlite type:
49
50                   •   filename: (str) path to database file
51
52                   •   threads: (int) number of threads in pool for SQLite
53                       connections. Default: number of CPUs
54
55                   •   timeout: (float) timeout in seconds for acquiring
56                       connection from pool or DB lock. Default: 5
57
58               •   Options for redis type:
59
60                   •   All parameters are passed to aioredis.from_url [0].
61                       Check there for a parameter reference.
62
63       proactive_policy_fetching
64
65           •   enabled: (bool) enable proactive policy fetching in the
66               background. Default: false
67
68           •   interval: (int) if proactive policy fetching is enabled, it is
69               scheduled every this many seconds. It is unaffected by
70               cache_grace and vice versa. Default: 86400
71
72           •   concurrency_limit: (int) the maximum number of concurrent
73               domain updates. Default: 100
74
75           •   grace_ratio: (float) proactive fetch for a particular domain is
76               skipped if its cached policy age is less than
77               interval/grace_ratio. Default: 2.0
78
79       default_zone
80
81           •   strict_testing: (bool) enforce policy for testing domains.
82               Default: false
83
84           •   timeout: (int) network operations timeout for resolver in that
85               zone. Default: 4
86
87           •   require_sni: (bool) add option servername=hostname to policy
88               responses to make Postfix send SNI in TLS handshake as required
89               by RFC 8461. Requires Postfix version 3.4+. Default: true
90
91       zones
92
93           •   ZONENAME:
94
95               •   Same as options in default_zone
96
97       The timeout is used for the DNS and HTTP requests.
98
99       MTA-STS "testing" mode can be interpreted as "strict" mode. This may be
100       useful (though noncompliant) in the beginning of MTA-STS deployment,
101       when many domains operate under "testing" mode.
102

EXAMPLE

104           host: 127.0.0.1
105           port: 8461
106           reuse_port: true
107           shutdown_timeout: 20
108           proactive_policy_fetching:
109             enabled: true
110             interval: 86400
111             concurrency_limit: 100
112             grace_ratio: 2
113           cache:
114             type: internal
115             options:
116               cache_size: 10000
117           default_zone:
118             strict_testing: false
119             timeout: 4
120           zones:
121             myzone:
122               strict_testing: false
123               timeout: 4
124

SEE ALSO

126       mta-sts-daemon(1), mta-sts-query(1)
127

NOTES

129       0.
130           https://aioredis.readthedocs.io/en/latest/api/high-level/#aioredis.client.Redis.from_url
131
132
133
134postfix-mta-sts-resolver          2023-01-20             MTA-STS-DAEMON.YML(5)