MTA-STS-DAEMON(1)

📦
version 1.5.1 · 10 versions
, in ubuntu stonking

✨ mta-sts-daemon(1) ✨

okay bestie, welcome to the mta-sts-daemon page, section 1 of the manual 💖 this one lives in the postfix-mta-sts-resolver fam and it's literally the glow-up your mail server has been asking for 🫶

🌸 NAME 🌸

mta-sts-daemon — hands Postfix its MTA-STS policy like a little policy map delivery service 👑

🎀 SYNOPSIS 🎀

mta-sts-daemon [OPTION]...

🦋 DESCRIPTION 🦋

so basically this daemon 👏 opens 👏 a 👏 socket 👏 and Postfix can just slide in there, query it, and pull the MTA-STS policy for a domain. that's the whole vibe. it's giving "policy concierge" honestly.

the config file situation is fully documented in mta-sts-daemon.yml(5) — go read that if you wanna know what it's eating.

MTA-STS, which is specified in RFC 8461 [0], is a security standard for email servers. when a site sets up MTA-STS, other mail servers can require that the site authenticates successfully before forwarding mail over there. no cap. it's the "prove you're you before I hand over the mail" rule and honestly it ate 🔥

✨ OPTIONS ✨

  • -h, --help — pops up a help message and then dips out, that's it, that's the whole job 💅
  • -v, --verbosity VERBOSITY — sets how chatty the logs get. your choices are: debug, info (this is the default, bestie), warn, error, or fatal.
  • -c, --config FILE — where the config file lives. default: /etc/mta-sts-daemon.yml
  • -g, --group GROUP — change the eGID to this group. default: none (so it just stays as it is, no thoughts head empty).
  • -l, --logfile FILE — where you want the log file to go. default: none.
  • -p, --pidfile PIDFILE — the name of the file it writes the current pid into. default: none.
  • -u, --user USER — change the eUID to this user. default: none.
  • --disable-uvloop — do NOT use uvloop, even if uvloop is sitting right there being available. default: enabled if available (so it uses uvloop when it can, unless you tell it not to 🙈).

🌈 EXAMPLES 🌈

first up, configure Postfix in /etc/postfix/main.cf, like so:

smtp_tls_policy_maps = socketmap:inet:127.0.0.1:8461:postfix
smtp_tls_CApath = /etc/ssl/certs/

then reload Postfix. oh and then verify it's actually working, queen:

/usr/sbin/postmap -q dismail.de socketmap:inet:127.0.0.1:8461:postfix
⚠️ real talk though: this configuration overrides DANE TLS authentication. if you wanna meet the requirement of RFC 8461, section 2, you should list a DANE policy resolver (or a static lookup table for domains known to implement both MTA-STS & DANE) before mta-sts-daemon in smtp_tls_policy_maps. order matters, bestie, don't skip this part 😭

👑 SEE ALSO 👑

📝 NOTES 📝

  1. SMTP MTA Strict Transport Security (MTA-STS): https://tools.ietf.org/html/rfc8461

aaaand that's a wrap, bestie 🎀 this was postfix-mta-sts-resolver energy, dated 2026-04-29, and you absolutely understood all of it. slay, go configure your mail server, you've got this 💖✨

📦 where this page comes from