rlysnd control

What the far end said

From message_event, so this is why mail ended where it did — not where it ended up. A deferral is a retry in progress, not a loss.

Asserted on the answer, not on systemctl is-active. On 2026-08-15 the unit stayed active, the port stayed open and the service answered nothing for a day.

DKIM publication

Banned addresses

Egress reputation

unknown is not clean: a lookup that failed says nothing, and treating it as “not listed” is how a broken resolver reads as a clean bill of health.

What these levels mean

opportunistic

TLS if the far end offers it, certificate not checked, plaintext fallback. What this stack did before any of this existed.

required

No delivery without STARTTLS. The certificate is not checked. This is what “enforce encryption” normally means for outbound mail.

required + verify

STARTTLS and the certificate must verify against the MX name. Strict, and it will fail against a large part of the internet — self-signed certificates and mismatched names are ordinary out there, and those failures look like the other side being broken. Right for a named partner, wrong as a blanket policy.

Rules here are keyed by destination. The sending side is set per domain on the Domains tab; when both apply, the stricter of the two wins. A change takes about seven minutes to reach the wire — the delivery nodes re-provision every five minutes and kumod re-reads the file on a two minute TTL. Mail already queued keeps the level it was queued at.

What this shows, and what it deliberately does not

One row per submission connection, not one per log line. Measured on smtp01: 157 322 syslog lines produced 11 252 real connections in a day, and Postfix’s disconnect line already carries the whole session. Shipping every line into a shared production cluster would be fourteen times the entire message-event table every day.

Our own probes are excluded — keepalived on loopback is 85 % of all connections here, and the control worker probes both ports every two minutes. Both are already on the Health tab.

Auth reads ok/attempts. 0/0 and 0/3 are different clients: one never tried, the other tried three times and failed. The link to a message is Postfix’s queue id, taken from the Received header the message kept — not the client address, which for a message is a value the sender supplied.

Worker settings

These are stored in the database and read by the worker once per cycle, so a change takes effect without a restart. The set of settings is fixed by a migration — this form can change values and cannot add or remove one.

What is deliberately not here

Nothing that names a host. Probe targets — which URL, which SMTP port, which egress IP — live in the worker’s config file and change by deploy. A target list editable through this page would be a runtime-settable outbound-request list on the only internet-facing host in the stack. An interval cannot be pointed at an address, which is why intervals are safe to put here and addresses are not.