Chapter 06 Mail Transport & Defense Admin: #pSmtpQueue

SMTP Queue, Retry Schedule, ISP Throttling, Smart-Host & Live MX Tester

The outbound delivery engine resolves MX records, enforces MTA-STS and DANE TLSA policies, supports RFC 7435 opportunistic STARTTLS for shared-hosting MX peers, applies Dual-DKIM signatures, and manages 4xx deferral retries automatically.

Operational Tip & Architecture Note

Use the built-in Outbound MX, STARTTLS & DANE Live Tester (#pSmtpQueue) whenever a partner domain reports issues: it runs a real non-destructive TCP, EHLO, STARTTLS, and DANE TLSA handshake against their MX servers without sending an email.

Outbound Transport Security: Opportunistic vs. Enforced TLS

How SharpMailserver automatically balances strict cryptographic authentication with shared-hosting MX compatibility.

Reference / Configuration

1. Ziel-Domain hat DANE TLSA oder MTA-STS (mode: enforce):
   -> Strikte Zertifikats- & Hostname-Prüfung (Pflicht-TLS, kein Fallback).
2. Standard Port-25-MX ohne MTA-STS/DANE (Opportunistic STARTTLS, RFC 7435):
   -> Verschlüsselt per TLS 1.3/1.2 auch dann, wenn ein Shared-Hoster-MX
      ein Zertifikat auf seinen Provider-Namen präsentiert (kein unnötiger Bounce).
3. Domain-Policy RequireOutboundTls = true:
   -> Erzwingt striktes TLS für besonders schützenswerte Partner-Domains.

Settings, Default Values & Best Practices

Setting / Location	Description	Default Value	Production Best Practice
`RetryScheduleMinutes`	Comma-separated backoff intervals in minutes when a remote MX returns a transient 4xx deferral (such as greylisting or temporary throttling).	`5, 15, 60, 240, 720, 1440`	Keep default (5m first retry clears remote greylisting quickly; progressive steps span ~41 hours before generating a final DSN bounce).
`OutboundWorkerConcurrency`	Maximum number of concurrent outbound SMTP delivery workers across all destination domains.	`4 Worker`	4 to 8 workers suit typical SMB traffic; scale to 12-24 for high-volume transactional billing bursts.
`MaxConnectionsPerMxIp & RatePerMinute`	Caps simultaneous TCP sessions and messages/minute per destination MX IP/domain to prevent 421 rate-limit deferrals at major ISPs.	`2 Verbindungen · 60/Min.`	Keep conservative caps (2 concurrent connections, 30-60 msgs/min) especially when warming up a fresh IP address.
`Globaler Smart-Host & Domain-Routen`	Routes either all outbound mail through an upstream relay (when ISP blocks TCP 25) or specific domains to internal ERP/DMS/partner gateways.	`Direkter MX-Versand (leer)`	Prefer direct MX delivery whenever TCP 25 is open and PTR is aligned; use a Smart-Host on cloud VMs where outbound port 25 is blocked.
`Zertifikatsprüfung & TLS-Ausnahmen (RemoteCertificateNameMismatch)`	Configures globally (Opportunistic, IgnoreErrors, Strict) or per destination domain (blank TargetHost = Auto DNS-MX + StartTlsIgnoreCert) whether mail is delivered encrypted despite remote MX certificate hostname mismatches.	`Opportunistic (RFC 7435)`	Keep 'Opportunistic' by default; under strict policies, whitelist specific partner domains with 1 click directly from the active queue via StartTlsIgnoreCert.