	Work in Progress:
	this is a work in progress for the new SME 11 qpsmtpd configuration has marked this page as a Work in Progress. The contents off this page may be in flux, please have a look at this page history the to see list of changes.

qpsmtpd

qpsmtpd has been a core component of SME Server since SME 7, providing advanced spam fighting capabilities.

SME Server 9.2 introduced qpsmtpd 0.96 with several new capabilities. At the same time, smeserver-qpsmtpd has been updated to provide additional SME Server configuration options.

SME Server 10 start moving the services to systemd.

SME Server 11 will upgrade to qpsmtpd 1.0. At the same time, smeserver-qpsmtpd has been updated providing separate configuration for each running deamons and introducing a third running deamon now covering all usual SMTP ports 25 (qpsmtpd), 587 (new uqpsmtpd) and 465 (sqpsmtpd). Also SME11 provides a full systemd implementaiton of the services without runit. Softlimit has been increased from 50MB to 150MB.

Systemd Configuration

Some of the setting that were previously arranged using runit run script and multiple called script are all now present in systemd unit, with a dropin file to override default. The dropin file is templated

# /usr/lib/systemd/system/uqpsmtpd.service
[Unit]
Description=qpsmtpd on submission port
After=network.target network-online.target qpsmtpd.service

[Service]
Type=simple
LimitDATA=150000000
LimitSTACK=150000000
LimitMEMLOCK=150000000
Environment=PORT=587 INSTANCES=40 INSTANCES_PER_IP=5 QPSMTPD_CONFIG=/var/service/uqpsmtpd/config PATH=/var/qmail/bin:/bin:/usr/bin:/usr/local/bin TCPLOCALHOST=me
WorkingDirectory=/var/service/qpsmtpd/

ExecStartPre=/sbin/e-smith/service-status uqpsmtpd
ExecStartPre=/sbin/e-smith/systemd/qpsmtpd-init %N
ExecStart=/usr/bin/qpsmtpd-forkserver \
        -u qpsmtpd \
        -l 0.0.0.0 \
        -p $PORT \
        -c $INSTANCES \
        -m $INSTANCES_PER_IP
ExecReload=/bin/kill -HUP $MAINPID
Restart=always
RestartSec=20s
SyslogIdentifier=uqpsmtpd

[Install]
WantedBy=sme-server.target

# /usr/lib/systemd/system/uqpsmtpd.service.d/50koozali.conf
#------------------------------------------------------------
#              !!DO NOT MODIFY THIS FILE!!
# 
# Manual changes will be lost when this file is regenerated.
#
# Please read the developer's guide, which is available
# at http://www.contribs.org/development/
#
# Copyright (C) 1999-2006 Mitel Networks Corporation
#------------------------------------------------------------
[Service]
LimitDATA=150000000
LimitSTACK=150000000
LimitMEMLOCK=150000000
Environment=
Environment=QPSMTPD_CONFIG=/var/service/uqpsmtpd/config PORT=587 INSTANCES=10 INSTANCES_PER_IP=5 PATH=/var/qmail/bin:/bin:/usr/bin:/usr/local/bin TCPLOCALHOST=sme11.example.com

Services folders

/var/service/qpsmtpd
/var/service/qpsmtpd/config
/var/service/qpsmtpd/config/dkim
/var/service/qpsmtpd/config/peers
/var/service/qpsmtpd/peers
/var/service/qpsmtpd/ssl
/var/service/sqpsmtpd
/var/service/sqpsmtpd/supervise
/var/service/sqpsmtpd/config
/var/service/sqpsmtpd/config/dkim -> ../../qpsmtpd/config/dkim
/var/service/sqpsmtpd/config/peers
/var/service/sqpsmtpd/peers
/var/service/qpsmtpd/ssl -> ../qpsmtpd/ssl
/var/service/uqpsmtpd
/var/service/uqpsmtpd/config
/var/service/uqpsmtpd/config/dkim -> ../../qpsmtpd/config/dkim
/var/service/uqpsmtpd/config/peers
/var/service/uqpsmtpd/peers
/var/service/qpsmtpd/ssl -> ../qpsmtpd/ssl

Properties in configuration db

x: use the value of qpsmtpd key property for this key too.
property	qpsmtpd	sqpsmtpd	uqpsmtpd
Authentication	enabled	enabled	enabled
Bcc	disabled	x	x
BccMode	cc	x	x
BccUser	maillog	x	x
DNSBL	disabled	x	x
Instances	40	10	10
InstancesPerIP	5	5	5
LogLevel	6	x	x
MaxScannerSize	25000000	x	x
MaximumDateOffset	0	x	x
PatternsScan	disabled	x	x
Proxy	blocked	x	x
RBLList	bl.spamcop.net,dnsbl-1.uceprotect.net,dnsbl-2.uceprotect.net,psbl.surriel.com,zen.spamhaus.org	x	x
RHSBL	disabled	x	x
RelayRequiresAuth	enabled	x	x
SoftLimit	150000000	150000000	150000000
SBLList	multi.surbl.org,black.uribl.com,rhsbl.sorbs.net	x	x
TCPPort	25	465	587
TCPProxyPort	25	x	x
TlsBeforeAuth	1	1 (hardcoded)	1 (hardcoded)
UBLList	multi.surbl.org:8-16-64-128,black.uribl.com,rhsbl.sorbs.net	x	x
URIBL	disabled	x	x
VirusScan	enabled	x	x
access	public	public	public
qplogsumm	disabled	x	x
status	enabled	enabled	enabled
tnef2mime	enabled	x	x

Config files

template: is templated individually ; metadata: use another template via a metadata file.
config file	qpsmtpd	sqpsmtpd	uqpsmtpd	plugin	related properties	information
badhelo	template	metadata	metadata	helo
badmailfrom	template	metadata	metadata	badmailfrom badmailfromto badrcptto
badrcptto	template	metadata	metadata	badrcptto check_goodrcptto		fixed output
badrcptto_ext	template	metadata	metadata	badrcptto		hide emails when db accounts setprop ACCOUNT Visible internal
dkim	folder	folder	folder			not in use
dnsbl_allow	template	metadata	metadata	dnsbl
dnsbl_zones	template	metadata	metadata	dnsbl per_user_config	$qpsmtpd{RBLList}
forcespamcheck	template	metadata	metadata	forcespamcheck		empty file, plugin set in peers
goodrcptto	template	metadata	metadata	check_goodrcptto
invalid_resolvable_fromhost	template	metadata	metadata	resolvable_fromhost		fixed output
IP	template	metadata	metadata			IP for tcpserver to bind to , 0 for all, fixed to 0
loglevel	template	metadata	metadata	logterse (...)	$qpsmtpd{LogLevel}
memory_threshold	template	metadata	metadata			fixed to 1
norelayclients	template	metadata	metadata	relay		$GatewayIP if set
peers	folder	folder	folder	peers		see peers section
plugin_dirs	template	metadata	metadata			fixed output /usr/share/qpsmtpd/plugins
plugins	x	x	x	x	x	has a copy of peers fragments, hidden by metadata
relayclients	template	metadata : to remove?	metadata: to remove?	greylisting relay spamassassin		IP allowed for relay without auth
rhsbl_zones	template	metadata	metadata	rhsbl	$qpsmtpd{SBLList}
signatures_patterns	template	metadata	metadata			uses db mailpatterns
smtpgreeting	template	metadata	metadata		$qpsmtpd{Greeting}	default to host.domain
spool_dir	template	metadata	metadata			fixed output /var/spool/qpsmtpd
spool_perms	x	x	x			file, do not alter
subject_prefix	template	metadata	metadata		$spamassassin{Subject}
timeout	template	metadata	metadata		$qpsmtpd{timeout}	120 as default
timeoutsmtpd	template	metadata	metadata		$qpsmtpd{timeoutsmtpd}	120 as default
tls_before_auth	template	template	template		$qpsmtpd{TlsBeforeAuth}	hardcoded for uqpsmtpd and sqpsmtpd
tls_ciphers	template	template	template	tls	$qpsmtpd{TlsBeforeAuth} $sqpsmtpd{TlsBeforeAuth} $uqpsmtpd{TlsBeforeAuth}	sqpsmtpd default to uqpsmtpd global default is $modSSL{CipherSuite}
tls_protocols	template	template	template	tls	SSLv2, SLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3	TLS1.2 minimum for uqpsmtpd and sqpsmtpd TLS1.1 minimum for qpsmtpd properties are set individually for each service
uribl_zones	template	metadata	metadata		$qpsmtpd{UBLList}

Peer plugin configuration


plugin	qp local	qp 0	sqp local	sqp 0
00setup
02logterse
04tls
05auth_cvm_unix_local
06auth_imap
09karma	X		X
10earlytalker	X		X
11bogus_bounce
12count_unrecognized_commands	X		X
13bcc
14relay
15helo	X		X
16resolvable_fromhost	X		X
17headers
19loadcheck	X		X
20rhsbl	X		X
221spf	X		X
222dkim
223dmarc	X		X
22dnsbl	X		X
23naughty	X		X
24uribl
30badmailfrom
34badrcptto		X		X
34badrcptto_ext	X		X
37check_smtp_forward
38check_goodrcptto
39rcpt_ok
62pattern_filter
62tnef2mime
65disclaimer		X		X
70spamassassin	X		X
	71forcespamcheck		71forcespamcheck
80clamav
90queue-qmail-queue
90queue-smtp-forward

Upgrade Considerations

A-Record DNSBL Services

Some DNSBL services - notably b.barracudacentral.org - provide their results using a DNS "A" record instead of a DNS TXT record. The dnsbl plugin requires these services to include a colon (":") in dnsbl_zones - however, SME used to use a colon the server separator in the configuration database. In order to support these A-Record DNSBL services, the separator for RBLList, SBLList, and the new UBLList is now a comma.

You can now configure b.barracudacentral.org using (note the single quotes):

config setprop qpsmtpd RBLList server1,server2,'b.barracudacentral.org:Blocked - see <http://bbl.barracudacentral.com/q.cgi?ip=%IP%>'

DKIM & DMARC

DKIM & DMARC are now supported natively by SME Server. To enable these you will need to configure appropriate DNS records in your public DNS server.

There are forum reports of problems for users who had DKIM enabled using the DKIM contrib.

URIBL

qpsmtpd now supports URIBL - the ability to block emails that contain known malicious URLs within the body of the email. This service is disabled by default.

Enable URIBL with the default services using:

config setprop qpsmtpd URIBL enabled
  signal-event email-update

Note: If your SME server is using high traffic external DNS forwarders like google (8.8.8.8 / 8.8.4.4), opendns (208.67.222.222 / 208.67.220.220), or any large ISP's (Cox, Comcast, Verizon), enabling URIBL may block all incoming email. This will only affect you if you have configured a DNS forwarder in server-manager -- a default SME server installation does its own direct DNS lookups and would not be affected unless you receive over 250,000 emails per day.

Read more at http://uribl.com/refused.shtml

"Naughty" plugin

SME Server is now using the 'naughty' plugin which allows early plugins like dnsbl, earlytalker, etc to indicate that the email should be rejected at a later point in the interaction. This allows the server to log extra information for denied emails. Specifically, emails denied by dnsbl will now show the sender and recipient email addresses in the qpsmtpd log

Plugins

Below is a list of all the plugins from /usr/share/qpsmtpd/plugins on a freshly updated SME 9.2 server.

+ New in SME 9.2 * Improved or changed in SME 9.2 U Unused (by default) in SME Server E Extra / External Configuration Required CW Contrib or Wiki page exists that uses this plugin SM Can be configured using server-manager DB Can be configured using db variables AC Auto-configured by SME Server

Qpsmtpd/sme11

Contents