Configuring qmail

April 18, 2025 by Roberto Puzzanghera 109 comments

More info on Life with qmail
README.vdelivermail

qmail v2025.04.18 and later include a new config-all script to automate the qmail core configuration. Several scripts are now embedded in qmail and automatically installed if one simply run './config-all mx.domain.tld' after the compilation. This is what will be installed and configured by the quick installation:

main control files as per original config-fast script,
aliases,
RBL
SPF
SRS (uses control/me as the srs_domain),
log dirs in /var/log/qmail,
cronjobs
logrotate
PATH and MANPATH in /etc/profile.d/qmail.sh
tcprules (basic, just to make initial tests),
supervise scripts,
qmailctl script,
DKIM control/filterargs and control/domainkeys dir,
SURBL,
overlimit feature,
moreipme,
smtpplugins,
helodnscheck spp plugin,
svtools,
qmHandle,
queue-repair,
SSL key file (optional)

From now on, running ./config-all mx.mydomain.tld after the compilation will get the qmail installation ready for testing. You'll only have to add your virtual domains and the other features not listed above.

Those who prefer to manually configure everything can stick with the original config-fast script, which now copies my supervise scripts to the qmail/doc dir.

In the following, the "Manual configuration" section is of course a suggested reading in order to have a view of how everything works, especially for newbies.

Consider this feature as testing for the time being. Feedbacks are appreciated.

Changelog

Apr 15, 2025
- added script config-all.sh
Jul 31, 2024
- multilog uses "d" flag as default to gain compatibility with the readable datetime format of multilog in daemontools-0.78. Change it with the "t" flag if you prefer to have timestamps.

Quick configuration

Run the config-all script in the source directory to configure and install the following:

main control files as per original config-fast script,
aliases,
RBL
SPF
SRS (uses control/me as the srs_domain),
log dirs in /var/log/qmail,
cronjobs
logrotate
PATH and MANPATH in /etc/profile.d/qmail.sh (also for vpopmail and dovecot)
tcprules (basic, just to make initial tests),
supervise scripts,
qmailctl script,
DKIM control/filterargs and control/domainkeys dir,
SURBL,
overlimit feature,
moreipme,
smtpplugins,
helodnscheck spp plugin,
svtools,
qmHandle,
queue-repair,
SSL key file (optional)

./config-all mx.mydomain.tld

The remaining of this page is a suggested reading in order to have a view of how everything works, especially for newbies.

mx.mydomain.tld must have valid MX, SPF, DKIM and DMARC records.

Be aware that both the config-all and config-fast script have to be run after the compilation, i.e. the make command on qmail sources; at this stage the QMAIL string will be replaced by the qmail directory stored in qmail-conf. The compiled files will be config-all and config-fast.

Manual configuration

As already mentioned, this is the classic configuration. I leave the old notes intact as they are important material to understand what you have already installed if you followed the quick configuration.

Defining alias and control files

QMAILDIR=/var/qmail
echo 3 > $QMAILDIR/control/spfbehavior
echo "| ~vpopmail/bin/vdelivermail '' delete" > $QMAILDIR/control/defaultdelivery
echo 200 > $QMAILDIR/control/concurrencyincoming
echo noreply > $QMAILDIR/control/bouncefrom
echo 20000000 > $QMAILDIR/control/databytes
echo 272800 > $QMAILDIR/control/queuelifetime
echo 30000000 > $QMAILDIR/control/softlimit
echo 100 > $QMAILDIR/control/maxrcpt
echo 2 > $QMAILDIR/control/brtlimit
echo 'HIGH:MEDIUM:!MD5:!RC4:!3DES:!LOW:!SSLv2:!SSLv3' > $QMAILDIR/control/tlsserverciphers

cd /usr/local/src/qmail
./config-fast mx.mydomain.tld

When you run ./config-fast it will automatically populate these files: defaultdomain, locals, me, plusdomain, rcpthosts. mx.yourdomain.tld will be the name of your MTA and it must have a valid MX record.

defaultdomain when you have many domains on the same server (defined later in the virtualhost file) this is the default domain
locals domains that we deliver locally (qmail-send via qmail-lspawn program). Other domains are spawned by qmail-rspawn and delivered to other MTAs. The domains listed in locals should not be confused with virtualdomains; infact, qmail-send doesn't even read virtualdomains if the recipient domain is already listed in locals and in that case you'll get a "no mailbox" error message. This is the reason why it's not a good idea to use a virtualdomain as the name of the MTA.
me the name of the server. This is the domain name that appers in the from field when you receive system messages, for instance. It's also the domain used in the HELO (i.e. the greeting at the very beginning of the SMTP conversation). It must have a valid MX record in our DNS, and also the SPF and DKIM records as we'll see later. Also, me should be your reverse DNS domain, as some provider may block you if the HELO domain is not associated with the IP address.
plusdomain domain substituted for trailing "+"
rcpthosts Domains that we accept mail for. Later you will see how chkuser rejects incoming emails for non existing recipients.
spfbehavior concerns the SPF configuration.
softlimit sets soft resource limits for qmail-smtpd
bouncefrom is the username of bounce sender. You may want to define bouncefrom as well, i.e. the domain of bounce sender, which defaults to me.
databytes is the max number of bytes in message (0=no limit).
queuelifetime are the seconds a message can remain in queue.
maxrcpt sets a limit on how many recipients are specified for any one email message (qmail-maxrcpt patch).
brtlimit is the maximum allowed numer of not found recipients. The connection with the remote host will be closed if this number is exceeded (brtlimit patch)
defaultdelivery is the default .qmail file. It tells qmail how to deliver the email. In case you didn't understand yet how the delivery is done, please read at this point the relaying chapter of Life with qmail and expecially the README.vdelivermail that comes with vpopmail, which explains how the .qmail files are used.
tlsserverciphers sets the allowed cipher suite in the TLS connection. In this configuration SSL is denied, while TLS v. 1 and 1.1 (deprecated) are allowed. If you want to deny TLS v. 1 and 1.1 as well add :!TLSv1 at the end of the line.

You can find an exhaustive presentation of all control configuration files on Life with qmail book http://www.lifewithqmail.org/lwq.html#configuration

Setup the primary administrator's email address. This address will receive mail for root, postmaster, and mailer-daemon. Replace postmaster@mydomain.tld with the administrator email address (postmaster):

cd $QMAILDIR/alias
echo "postmaster@mydomain.tld" > .qmail-postmaster
ln -s .qmail-postmaster .qmail-mailer-daemon
ln -s .qmail-postmaster .qmail-root
chmod 644 .qmail*

Setup the log dirs

The log dirs belong to qmaill.nofiles user and should not be accessible by other users

mkdir -p /var/log/qmail

chown -R qmaill:nofiles /var/log/qmail
chgrp root /var/log/qmail
chmod -R og-wrx /var/log/qmail
chmod g+rx /var/log/qmail

Defining the supervise scripts

supervise scripts
References: tcpserver page

Copy the startup scripts from the qmail/doc/example-supervise directory. Do not copy&paste from the below examples as they are not updated and could possibly contain exadecimal characters which would break the run of the script itself.

cd $QMAILDIR 
cp -rp doc/example-supervise/* .

You can see the rc excutable, which is the qmail-start script, and the supervise folder:

rc
supervise/
|
|----clear/
|    |
|    |----run
|    |----down
|
|----qmail-smtpd/
|    |
|    |-----run
|    |-----log/
|          |
|          |---run
|
|----qmail-smtpsd/
|    |
|    |-----run
|    |-----log/
|          |
|          |---run
|
|----qmail-submission/
|    |
|    |-----run
|    |-----log/
|          |
|          |---run
|
|----qmail-send/
|    |
|    |-----run
|    |-----log/
|          |
|          |---run
|
|----vpopmaild/
|    |
|    |-----run
|    |-----log/
|          |
|          |---run
|
|----vusaged/
     |
     |-----run
     |-----log/
           |
           |---run

When you create symbolic links to a supervise directory in the /service dir, the run command will be executed when /command/svcscanboot is launched, i.e. at boot time.

QMAILDIR=/var/qmail
ln -s $QMAILDIR/supervise/qmail-smtpd      /service
ln -s $QMAILDIR/supervise/qmail-smtpsd     /service
ln -s $QMAILDIR/supervise/qmail-submission /service
ln -s $QMAILDIR/supervise/qmail-send       /service
ln -s $QMAILDIR/supervise/vpopmaild        /service
ln -s $QMAILDIR/supervise/vusaged          /service
ln -s $QMAILDIR/supervise/clear            /service

Let's see more in detail the supervise scripts. Many lines are still commented out because concern features that can be activated later.

File qmail/rc

#!/bin/sh 

# qmail dir retrieved from qmaild user in /etc/passwd
QMAILDIR=$(getent passwd qmaild | cut -d: -f6)

# Comment out DKIM_ON=1 to disable dkim sign at qmail-remote level 
# You have to define your variables in control/filterargs (DKIM page for more info)
# echo "*:remote:/var/qmail/bin/qmail-dkim:DKIMQUEUE=/bin/cat,DKIMSIGN=/var/qmail/control/domainkeys/%/default,DKIMSIGNOPTIONS=-z 2" > /var/qmail/control/filterargs

DKIM_ON=1 

if [ -r $QMAILDIR/control/filterargs ] && [ -n "$DKIM_ON" ]; then 
  # DKIM sign at qmail-remote level
  exec env - PATH="$QMAILDIR/bin:$PATH" \
  QMAILREMOTE=$QMAILDIR/bin/spawn-filter \
  qmail-start "`cat $QMAILDIR/control/defaultdelivery`" 
else 
  exec env - PATH="$QMAILDIR/bin:$PATH" \
  qmail-start "`cat $QMAILDIR/control/defaultdelivery`" 
fi

Do not bother of the lines concerning the DKIM settings. The server can work with those lines active. We will cover that topic later in this guide.

`clear` service

The "clear" service can easily clear the readproctitle service errors line (qmailctl clear):

#!/bin/sh
yes '' | head -4000 | tr '\n' .

Touch the 'down' file:

touch /var/qmail/supervise/clear/down

File qmail/supervise/qmail-smtpd/run

#!/bin/sh

QMAILDIR=$(getent passwd qmaild | cut -d: -f6)
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat $QMAILDIR/control/concurrencyincoming`
SOFTLIMIT=`cat $QMAILDIR/control/softlimit`
LOCAL=`head -1 $QMAILDIR/control/me`
TCPRULES_DIR=/var/qmail/control

#export REJECTNULLSENDERS=1
#export SMTPAUTH="!cram"

# qmail-spp plugins
export ENABLE_SPP=1
export HELO_DNS_CHECK=PLRIV

# enable greetdelay for qmail-smtpd
export SMTPD_GREETDELAY=20
export DROP_PRE_GREET=1

# greylisting
#export JGREYLIST_DIR="$QMAILDIR/jgreylist"
#export JGREYLIST_LOG_SMTP=1

# enable chkuser
export CHKUSER_START=ALWAYS

################### DKIM - SURBL configuration #################################
# DKIMQUEUE and SURBLQUEUE are front-ends of qmail-queue
export SURBL=1 # enable SURBL filtering

# If simscan is not installed yet, do not assign QMAILQUEUE
# so that the installation works at the beginning stage as well
if [ -x $QMAILDIR/bin/simscan ]; then
  export QMAILQUEUE=$QMAILDIR/bin/surblqueue # executes surblfilter
  export SURBLQUEUE=$QMAILDIR/bin/simscan    # executes simscan after SURBL
  #export QMAILQUEUE=$QMAILDIR/bin/simscan # do not execute SURBL nor DKIM filtering

  #### qmail-dkim disabled => no dkim verification
  #### to have verification active export SURBLQUEUE=$QMAILDIR/bin/qmail-dkim. Othewise the following will be ignored
  #export SURBLQUEUE=$QMAILDIR/bin/qmail-dkim # executes qmail-dkim after surblfilter

  export DKIMQUEUE=$QMAILDIR/bin/simscan     # simscan is executed after qmail-dkim

  # DKIM verification. Use carefully
  export DKIMVERIFY="FGHKLMNOQRTVWp"
  # allow msg without "subject" in the h= list
  export UNSIGNED_SUBJECT=1
  # avoid verification of outgoing messages
  export RELAYCLIENT_NODKIMVERIFY=1
fi
################################################################################

# turn off TLS on port 25
#export DISABLETLS="1"

# rcptcheck-overlimit. Limits the number of emails sent by relayclients
if [ -x $QMAILDIR/bin/rcptcheck-overlimit ]; then
  export RCPTCHECK=$QMAILDIR/bin/rcptcheck-overlimit
  export RCPTCHECKRELAYCLIENT="1"
fi

# enable simscan debug
#export SIMSCAN_DEBUG=4
#export SIMSCAN_DEBUG_FILES=2

exec /usr/local/bin/softlimit -m "$SOFTLIMIT" \
    /usr/local/bin/tcpserver -v -R -l "$LOCAL" \
    -x $TCPRULES_DIR/tcp.smtp.cdb -c "$MAXSMTPD" \
    -u "$QMAILDUID" -g "$NOFILESGID" 0 25 \
    $QMAILDIR/bin/qmail-smtpd /bin/true 2>&1

Note that the standard smtp (port 25) does not allow the authentication.

You have to adjust the resource limit (softlimit in bytes). Each system is different, and has different requirements. Life with qmail suggests just 2MB. You have to experiment the correct value increasing by steps of 1MB, especially once you have loaded spamassassin, clamAV and simscan (the mail scanner).

We'll cover GREETDELAY and DKIM later.

`multilog` considerations

multilog program

As already mentioned in the daemontools page, you can get multilog to print loglines with timestamps, as the original program's behaviour does, or with a human readable datetime format. The usage changes as far as the very first argument is concerned, as timestamp goes with t while the readable datetime goes with a d.

So, these is the usage for datetime:

multilog d <other-arguments> <script>

which prints something like

2024-07-31 18:06:03.823254532 tcpserver: status: 0/200/0

and this is for timestamps

multilog t <other-arguments> <script>

which prints something like

@4000000066aa062d281ba97c tcpserver: status: 0/200/0

This guide uses datetime as default.

File qmail/supervise/qmail-smtpd/log/run

#!/bin/sh

LOGUSER="qmaill"
LOGDIR="/var/log/qmail/smtpd"
LOGDIRQLOG="/var/log/qmail/smtpd/qlog"
NLOGS=50

exec /usr/local/bin/setuidgid $LOGUSER /usr/local/bin/multilog d n5 s16777215 $LOGDIR \
  n$NLOGS s16777215 '-*' '+*qlog*' $LOGDIRQLOG

In this way we have the /var/log/qmail/smtpd/qlog/current file with just the qlog lines in human-readable time format:

2016-01-29 13:15:17.677946500 qlogenvelope: result=accepted code=250 reason=rcptto detail=chkuser helo=smtp.senderdomain.com mailfrom=sender@senderdomain.com rcptto=user@rcptdomain.com relay=no rcpthosts=yes size= authuser= authtype= encrypted= sslverified=no localip=10.0.0.4 localport=25 remoteip=83.103.72.231 remoteport=43618 remotehost= qp= pid=11928
2016-01-29 13:15:17.677946500 qlogreceived: result=accepted code=250 reason=queueaccept detail= helo=smtp.senderdomain.com mailfrom=sender@senderdomain.com rcptto=user@rcptdomain.com relay=no rcpthosts= size=2689 authuser= authtype= encrypted= sslverified=no localip=10.0.0.4 localport=25 remoteip=83.103.72.231 remoteport=43618 remotehost= qp=11934 pid=11928

File qmail/supervise/qmail-smtpsd/run

#!/bin/sh

QMAILDIR=$(getent passwd qmaild | cut -d: -f6)
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat $QMAILDIR/control/concurrencyincoming`
SOFTLIMIT=`cat $QMAILDIR/control/softlimit`
LOCAL=`head -1 $QMAILDIR/control/me`
TCPRULES_DIR=/var/qmail/control

SSL_DIR="$QMAILDIR/control"
SSL_CHROOT="$SSL_DIR"
SSL_UID=$QMAILDUID
SSL_GID=$NOFILESGID
CERTFILE="$SSL_DIR/servercert.pem"
KEYFILE="$SSL_DIR/servercert.pem"
DHFILE="$SSL_DIR/dh4096.pem"
export SSL_UID SSL_GID SSL_CHROOT
export CERTFILE KEYFILE DHFILE

#export REJECTNULLSENDERS=1
export SMTPAUTH="!"

# qmail-spp plugins
export ENABLE_SPP=1
export HELO_DNS_CHECK=PLRIV

# This enables greetdelay for qmail-smtpd
export SMTPD_GREETDELAY=20
export DROP_PRE_GREET=1

# greylisting
#export JGREYLIST_DIR="$QMAILDIR/jgreylist"
#export JGREYLIST_LOG_SMTP=1

# enable chkuser
export CHKUSER_START=ALWAYS

# turn off TLS on port 465
export DISABLETLS=1
export FORCETLS=0

# require that authenticated user and 'mail from' are identical
export FORCEAUTHMAILFROM="1"

# rcptcheck-overlimit. Limits the number of emails sent by relayclients
if [ -x $QMAILDIR/bin/rcptcheck-overlimit ]; then
  export RCPTCHECK=$QMAILDIR/bin/rcptcheck-overlimit
  export RCPTCHECKRELAYCLIENT="1"
fi

exec /usr/local/bin/softlimit -m "$SOFTLIMIT" \
    /usr/local/bin/sslserver -seV -Rp -l "$LOCAL" \
    -Xx $TCPRULES_DIR/tcp.smtp.cdb -c "$MAXSMTPD" \
    -u "$QMAILDUID" -g "$NOFILESGID" 0 smtps \
    $QMAILDIR/bin/qmail-smtpd ~vpopmail/bin/vchkpw /bin/true 2>&1

File qmail/supervise/qmail-smtpsd/log/run

#!/bin/sh

LOGUSER="qmaill"
LOGDIR="/var/log/qmail/smtpsd"

exec /usr/local/bin/setuidgid $LOGUSER /usr/local/bin/multilog d n5 s16777215 $LOGDIR

File qmail/supervise/qmail-send/run

#!/bin/sh
QMAILDIR=/var/qmail
exec $QMAILDIR/rc

File qmail/supervise/qmail-send/log/run

#!/bin/sh
exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog d s16000000 n200 /var/log/qmail/send

File qmail/supervise/qmail-submission/run

This service makes the MTA also act as an outgoing relay, but the user must authenticate (with TLS encryption).

#!/bin/sh

QMAILDIR=$(getent passwd qmaild | cut -d: -f6)
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat $QMAILDIR/control/concurrencyincoming`
SOFTLIMIT=`cat $QMAILDIR/control/softlimit`
LOCAL=`head -1 $QMAILDIR/control/me`
TCPRULES_DIR=/var/qmail/control

# You MUST export this, otherwise you'd get a 30 sec timeout
# "!" if you want the submission feature (auth required)
export SMTPAUTH="!"

# This enables greetdelay for qmail-smtpd.
export SMTPD_GREETDELAY=3
export DROP_PRE_GREET=1

# This enables chkuser
export CHKUSER_START=ALWAYS

# This makes qmail to allow connections without TLS (default 1)
#export FORCETLS=0

# This turns off TLS on port 587 (default 0)
#export DISABLETLS=1

# Requires that authenticated user and 'mail from' are identical (default 0)
export FORCEAUTHMAILFROM=1

# rcptcheck-overlimit. Limits the number of emails sent by relayclients
#export RCPTCHECK=$QMAILDIR/bin/rcptcheck-overlimit
#export RCPTCHECKRELAYCLIENT=1

exec /usr/local/bin/softlimit -m "$SOFTLIMIT" \
    /usr/local/bin/tcpserver -v -R -l "$LOCAL" \
    -x $TCPRULES_DIR/tcp.submission.cdb -c "$MAXSMTPD" \
    -u "$QMAILDUID" -g "$NOFILESGID" 0 587 \
    $QMAILDIR/bin/qmail-smtpd \
    ~vpopmail/bin/vchkpw /bin/true 2>&1

Note the use of vchkpw in conjunction with qmail-smtpd to ensure authentication. The connection requires TLS enabled. This is the reason why we opened a separate secure connection on port 587 to allow remote clients to use our MTA as a relay.

The SMTPAUTH variable is related to the authentication patch. You are invited to take a look to the README.auth file for further details.

File qmail/supervise/qmail-submission/log/run

#!/bin/sh

LOGUSER="qmaill"
LOGDIR="/var/log/qmail/submission"

exec /usr/local/bin/setuidgid $LOGUSER /usr/local/bin/multilog d s16000000 n200 $LOGDIR

File qmail/supervise/vpopmaild/run

#!/bin/sh
QMAILDUID=`id -u root`
NOFILESGID=`id -g root`
VPOPMAILID=`id -g vpopmail`

exec /usr/local/bin/softlimit -m 30000000 \
    /usr/local/bin/tcpserver -v -H -R -l 0 \
    -u $QMAILDUID -g $NOFILESGID 0 $VPOPMAILID \
    ~vpopmail/bin/vpopmaild 2>&1

vpopmaild is important when connecting to vpopmail via webmail to change the password, for instance.

File qmail/supervise/vpopmaild/log/run

#!/bin/sh

LOGUSER="qmaill"
LOGDIR="/var/log/qmail/vpopmail"

exec /usr/local/bin/setuidgid $LOGUSER /usr/local/bin/multilog d $LOGDIR

File qmail/supervise/vusaged/run

#!/bin/sh
exec ~vpopmail/bin/vusaged 2>&1

File qmail/supervise/vusaged/log/run

#!/bin/sh
exec setuidgid qmaill /usr/local/bin/multilog d /var/log/qmail/vusaged

cronjobs

To backup the log files of the qmail services we'll use the convert-multilog script from John Simpson (thanks to the author and to Marc for the suggestion) who describes the script as follows:

convert-multilog is a script which searches "/service/*/log/main" for any "@4*" files (the automatic cut-off files generated by multilog), converts their timestamps from tai64n to human-readable format, and writes them to /var/log/{service}.{date}. Once the lines from a given "@4*" file have been converted, the file is deleted.

The log files are saved separated by date, for example

-rw-r--r-- 1 root   root   259558 Aug 24 12:21 qmail-smtpd.2014-08-20
-rw-r--r-- 1 root   root   806917 Aug 24 12:21 qmail-smtpd.2014-08-21
-rw-r--r-- 1 root   root  1523116 Aug 24 12:21 qmail-smtpd.2014-08-22
-rw-r--r-- 1 root   root   364022 Aug 24 12:21 qmail-smtpd.2014-08-23

Inside each file the date is in human-readable format

2014-08-23 00:31:49.503947500 tcpserver: status: 1/20

This is very useful when you have to do quick searches.

Install like this:

mkdir -p /var/log/qmail/backup
wget -O  /var/qmail/bin/convert-multilog https://notes.sagredo.eu/files/qmail/convert-multilog
chmod +x /var/qmail/bin/convert-multilog

ln -s /var/log/qmail/send       /service/qmail-send/log/main 
ln -s /var/log/qmail/smtpd      /service/qmail-smtpd/log/main 
ln -s /var/log/qmail/smtpsd     /service/qmail-smtpsd/log/main
ln -s /var/log/qmail/submission /service/qmail-submission/log/main

NB: the script that you have downloaded is my modified version, which gains compatibility with the readable datetime format (daemontools' multilog_readable-datetime feature). If you decided to use timestamps, then download the original convert-multilog program.

Now set up a cronjob once a day. And since we want to convert each log file every day, we have to rotate them on a daily basis. So we'll add something like this to our crontab:

cat > /etc/cron.d/qmail << EOF
# convert-multilog
59 2 * * * /var/qmail/bin/convert-multilog 1> /dev/null
# qmail log
0 0  * * * /usr/local/bin/svc -a /service/qmail-submission/log
0 0  * * * /usr/local/bin/svc -a /service/qmail-smtpd/log
0 0  * * * /usr/local/bin/svc -a /service/qmail-smtpsd/log
0 0  * * * /usr/local/bin/svc -a /service/qmail-send/log
0 0  * * * /usr/local/bin/svc -a /service/vpopmaild/log
0 0  * * * /usr/local/bin/svc -a /service/vusaged/log
EOF

Be aware that at least on RedHat like OS the cronjob must hold the user who runs the job, so the same cronjobs must be as follows:

cat > /etc/cron.d/qmail << EOF
# convert-multilog
59 2 * * * root /var/qmail/bin/convert-multilog 1> /dev/null 
# qmail log
0 0 * * * root /usr/local/bin/svc -a /service/qmail-submission/log
0 0 * * * root /usr/local/bin/svc -a /service/qmail-smtpd/log
0 0 * * * root /usr/local/bin/svc -a /service/qmail-smtpsd/log
0 0 * * * root /usr/local/bin/svc -a /service/qmail-send/log
0 0 * * * root /usr/local/bin/svc -a /service/vpopmaild/log
0 0 * * * root /usr/local/bin/svc -a /service/vusaged/log
EOF

`PATH` and `MANPATH` settings

Add bin dir to your PATH and man dir to MANPATH

cat > /etc/profile.d/qmail.sh << __EOF__
PATH=\$PATH:/var/qmail/bin:/home/vpopmail/bin:/usr/local/dovecot/bin:/usr/local/dovecot-pigeonhole/bin
export PATH
MANPATH=\$MANPATH:/var/qmail/man:/usr/local/dovecot/share/man
export MANPATH
__EOF__

We have added the vpopmail, dovecot and dovecot-pigeonhole PATH in advance. Correct it if you have planned to install them elsewhere.

Creating an SSL key file

To secure the smtp authentication you must create the SSL certificate. The certificate must be owned by the user who runs qmail-smtpd, vpopmail in our case.

> make cert
    
Generating a 1024 bit RSA private key
..................++++++
.......++++++
writing new private key to '/var/qmail/control/servercert.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:IT
State or Province Name (full name) [Some-State]:Italy
Locality Name (eg, city) []:Cagliari
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Your Name
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:smtp.yourdomain.net
Email Address []:postmaster@yourdomain.net
    
> make tmprsadh
> chown vpopmail:vchkpw /var/qmail/control/*.pem

It is important that the “Common Name” matches the domain name that your email clients will specify as their SMTP server.

Now let’s create a cronjob to update the certificate every day:

> crontab -e
    
03 05 * * * /var/qmail/bin/update_tmprsadh > /dev/null 2>&1

Important: If you run qmail-submission as a user other than vpopmail, and you’re installing my combined patch, you must adjust /var/qmail/bin/update_tmprsadh accordingly. Otherwise you’ll probably exceed the connection timeout due to privilege problems, and won’t be able to send messages when connected remotely.

Installing a Let's Encrypt valid certificate

When everything is working and under your control it will be the time to install a valid certificate from Let's Encrypt, following the page "Installing a valid SSL certificate".

`qmailctl` script

Reference: Life with qmail
Download qmailctl (thanks to Sam Tang)

As usual we will put the script in /var/qmail/bin and give it the +x flag.

wget -O /var/qmail/bin/qmailctl https://raw.githubusercontent.com/sagredo-dev/qmail/refs/heads/main/scripts/qmailctl
chmod +x /var/qmail/bin/qmailctl

qmailctl is a pure bash script. Unix BSD users should install bash, edit the script and point the bash executable correctly in the very first line:

#!/usr/local/bin/bash

The startup script does the following:

Starts/stops the services
Calls tcprules to reload tcp.smtp.cdb and tcp.submission.cdb
Shows the status of the services and the queue
Shows the up/down status of some other related daemons
Shows the the date of the clamav database

Note that it starts and stops vpopmaild also, and starts both normal SMTP on port 25, and the submission service on port 587, where SMTP authentication is required to perform outgoing relay for remote users. In any event, be sure to review the service list to make sure it reflects the services you want to provide.

Usage

# qmailctl help

    stop -- stops mail service (smtp connections refused, nothing goes out)
   start -- starts mail service (smtp connection accepted, mail can go out)
   pause -- temporarily stops mail service (connections accepted, nothing leaves)
    cont -- continues paused mail service
    stat -- displays status of mail service
     cdb -- rebuild the tcpserver cdb file for smtp
 restart -- stops and restarts smtp, sends qmail-send a TERM & restarts it
 doqueue -- sends qmail-send ALRM, scheduling queued messages for delivery
  reload -- sends qmail-send HUP, rereading locals and virtualdomains
   queue -- shows status of queue
    alrm -- same as doqueue
   flush -- same as doqueue
     hup -- same as reload
   clear -- clears the readproctitle service errors with .....................
    kill -- svc -d processes in svclist, then do 'killall -g svscanboot'
    boot -- Boots qmail and all services in /service running /command/svscanboot
  reboot -- kill & boot commands in sequence

qmailctl can be used to kill all qmail processes and to reboot the server. I use this option inside the rc.6 of my Slackware virtual server to avoid errors messages when stopping or rebooting the guest. You can easily call the clear service as well.

Compiling the `tcprules`

Create a tcprules file for qmail-smtpd

cat > /var/qmail/control/tcp.smtp << EOF
0.0.0.0:allow,RELAYCLIENT="",SMTPD_GREETDELAY="0"
127.:allow,RELAYCLIENT="",SMTPD_GREETDELAY="0"
:allow,CHKUSER_WRONGRCPTLIMIT="3"
EOF

and for qmail-submission

cat > QMAIL/control/tcp.submission << EOF
:allow
EOF

Compile your tcprules files:

> qmailctl cdb

Updated tcp.smtp.cdb. 
Updated tcp.submission.cdb.

You have to recompile the tcprules each time you modify tcp.smtp or tcp.submission. There's no need to restart qmail.

`svtools`

More info: https://github.com/sagredo-dev/svtools
Author: Klaus Reimer

This is a nice collection of tools to manage daemontools' services that you may want to consider. mlcat is one of those; it can cat a service's log with human readable dates with a short command like:

mlcat qmail-smtpd

I slightly modified that script, just to use it without the need of the "qmail-" prefix:

mlcat smtpd

Installing

git clone https://github.com/sagredo-dev/svtools.git
cd svtools
make
make install

Running `qmail` at boot time

The command /command/svcscanboot has been inserted in your /etc/inittab at the time you installed daemontools, or you have installed a daemontools systemd service, as already explained in the here.

Upgrading qmail

tcprules

qmail

add a comment

Comments

error Script Config-fast and Config-all

Scalibur June 23, 2025 20:19 CET

Hi Riberto

In the config-all.sh and config-fast.sh scripts, QMAIL is mentioned as a variable, but it doesn't have a definition. You have to add QMAIL=/var/qmail at the beginning and change QMAIL to $QMAIL

which generates these errors.

example :

config-fast.sh: 11: cannot create QMAIL/control/me: Directory nonexistent
chmod: cannot access 'QMAIL/control/me': No such file or directory