1. Pillar 1: Zero-Trust Relay ACLs & CIDR Lockdown

The single most dangerous directive in any PowerMTA configuration is an open relay. By default, PowerMTA should never permit relaying to the public internet without explicit authentication. Your global <source 0/0> must operate under a zero-trust default-deny posture:

# ==============================================================================
# DEFAULT ZERO-TRUST SOURCE: REJECT RELAYING FROM ALL UNTRUSTED NETWORKS
# ==============================================================================
<source 0/0>
    # Allow incoming delivery for local domains only (MX mode)
    smtp-service yes
    
    # STRICTLY FORBID RELAYING FOR EXTERNAL ADDRESSES
    always-allow-relaying no
    
    # Require authentication if external client attempts relay
    require-auth yes
    
    # Require TLS before accepting authentication credentials
    require-starttls-before-auth yes
    
    # Defend against SMTP smuggling and malformed line endings
    disallow-bare-newlines yes
    strict-smtp-syntax yes
    disconnect-on-syntax-error yes
    
    # Connection throttles to prevent socket exhaustion
    max-connections-per-ip 10
    smtp-max-recipients-per-message 100
</source>

# TRUSTED INTERNAL SUBMISSION POOL (VPC / PRIVATE IP RANGE ONLY)
<source 10.240.0.0/16>
    smtp-service yes
    always-allow-relaying yes
    require-auth no
    log-connections yes
</source>

2. Pillar 2: Web Management Interface (Port 8080) Isolation

PowerMTA includes an administrative web monitor displaying real-time queues, Virtual MTA status, and server commands. Never bind the web monitor to a public IP address (0.0.0.0:8080).

• Bind to Localhost Exclusively: Set http-mgmt-port 127.0.0.1:8080.
• Access via Secure Reverse Proxy: Route web monitor access through Nginx or Caddy protected by Cloudflare Zero Trust Access or a WireGuard VPN tunnel.
• Mandatory HTTP Authentication: If remote HTTP access is required, enforce bcrypt-hashed HTTP credentials using http-access directives:

# Bind web monitor strictly to local loopback interface
http-mgmt-port 127.0.0.1:8080

# Restrict HTTP access to authorized administrative credentials
http-access 127.0.0.1 admin
<http-user admin>
    password "pbkdf2:sha256:260000$YourHighEntropyHashedAdminSecret"
</http-user>

3. Pillar 3: Mandatory SASL Authentication & Brute-Force Rate Limits

For submission ports (TCP 587 and 465), enable SASL authentication against a localized credentials database. Protect against credential stuffing attacks by capping authentication attempts:

# Disconnect and throttle clients after 3 consecutive failed auth attempts
max-auth-failures 3
auth-failure-delay 5s

# Submission listener port 587 configuration
<source 0/0:587>
    smtp-service yes
    always-allow-relaying no
    require-auth yes
    require-starttls-before-auth yes
    auth-file /etc/pmta/users.auth
</source>

4. Pillar 4: Dropping Root: Unprivileged User & Group Execution

By default on initial RPM installation, PowerMTA may launch as the root superuser. If an attacker discovers a remote code execution exploit in an underlying library, they gain full root ownership of the underlying server. PowerMTA natively supports dropping privileges after binding to low-numbered network ports (25, 465, 587):

# Drop root privileges immediately after port binding
run-as-user pmta
run-as-group pmta

Ensure that directory ownership across /var/spool/pmta and /var/log/pmta is updated accordingly: chown -R pmta:pmta /var/spool/pmta /var/log/pmta /etc/pmta.

5. Pillar 5: TLS 1.3 Protocols, Forward Secrecy & Strict Verification

Disable insecure legacy cryptographic protocols and outdated ciphers across both inbound listener and outbound delivery pipelines:

# Enforce modern TLS versions
ssl-protocols TLSv1.2, TLSv1.3

# Restrict to forward-secret AEAD cipher suites
ssl-cipher-list ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384

# Prefer server cipher order
ssl-prefer-server-ciphers yes

6. Pillar 6: Modern Systemd Sandboxing & Resource Containment

Protect the host operating system by wrapping the PowerMTA service unit in a restrictive systemd sandbox on AlmaLinux 9 / Ubuntu 24.04:

[Service]
# Restrict filesystem access to necessary directories only
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/spool/pmta /var/log/pmta /tmp
ReadOnlyPaths=/etc/pmta

# Prevent privilege escalation
NoNewPrivileges=yes

# Private tmp and device isolation
PrivateTmp=yes
PrivateDevices=yes

# Restrict network address families to IPv4 and IPv6
AddressFamilies=AF_INET AF_INET6 AF_UNIX

# Memory and file descriptor limits
LimitNOFILE=1048576
LimitNPROC=65536

7. Pillar 7: Spool Directory Permissions & Log Hygiene

The PowerMTA message spool contains pending and retried emails in transit, which may contain sensitive personal data, corporate documents, or passwords. Secure the spool directory:

• chmod 0700 /var/spool/pmta — Disallows any unprivileged user on the host from reading queued emails.
• chmod 0600 /etc/pmta/config /etc/pmta/*.key — Protects private DKIM keys and configuration secrets.
• Configure automated log rotation in /etc/logrotate.d/pmta to prevent disk-exhaustion denial of service attacks.

8. Pillar 8: Linux Kernel Network Stack Hardening

Under heavy outbound volume or SYN-flood DDoS attacks, default Linux kernel network parameters become overwhelmed. Harden /etc/sysctl.d/99-pmta-security.conf:

# Protect against SYN flood attacks
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 8192

# Disable IP source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# Ignore ICMP broadcast echo requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Protect against TIME_WAIT socket exhaustion at scale
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 15

# Expand local port range for concurrent outbound SMTP connections
net.ipv4.ip_local_port_range = 1024 65535

9. Pillar 9: Automated Fail2ban & Brute-Force Detection

Deploy a customized Fail2ban filter to parse PowerMTA’s /var/log/pmta/traffic.log for repeated authentication failures or syntax probe attacks, automatically dropping offending IP addresses via nftables or iptables at the firewall layer.

10. Pillar 10: Accounting Audit Trails & Configuration Immutability

Enable comprehensive accounting records in PowerMTA:

# Enable accounting for delivered, bounced, and transient events
<acct-file /var/log/pmta/acct.csv>
    move-to /var/log/pmta/archive
    move-interval 1h
    records d,b,t,v
</acct-file>

Use Linux chattr +i /etc/pmta/config once finalized in production to prevent unauthorized modification by compromised background services.