Receiving mail

Mail for your domains arrives on port 25, handled by the mx role. Nixt Server makes every decision it can while the sending server is still connected. A message is either refused with a reason the sender sees at once, or accepted and stored durably before the server says so. The server never accepts a message and bounces it later because a recipient does not exist.

The steps

1. Connection. Connection limits and a short pause before the greeting.
2. Greeting and EHLO. The server says what it supports.
3. STARTTLS. The sender can encrypt the conversation.
4. Sender and recipients. Each recipient is checked against the directory.
5. The message. Size and line-ending rules while it arrives.
6. Authentication. SPF, DKIM, DMARC, ARC and reverse DNS.
7. Filtering. The filter pipeline decides to deliver, tag, quarantine, refuse or defer.
8. Acceptance. The message and its queue entry are written, and the sender is told the queue id.
9. Delivery. The message goes into each recipient’s mailboxes, through their Sieve script.

1. Connection

A network is an IPv4 /24 or an IPv6 /48. Change these ceilings, add rates, or exempt your own ranges in [listeners.mx]; see Connection ceilings. Behind a load balancer, set proxy_protocol = true on [listeners.mx] so these rules and the recorded client address use the real sender’s address.

2. Greeting and EHLO

220 mail.example.com ESMTP Nixt Server

The EHLO reply lists:

Port 25 never offers AUTH or BURL. VRFY answers 252 2.5.2 Cannot VRFY user; try RCPT to attempt delivery, and EXPN and ETRN answer 502 5.5.1 Command not implemented.

The numbers in SIZE and LIMITS are the ceilings in force when the connection opened, including any lowered in runtime settings, and they hold for the whole connection.

3. STARTTLS

The sender may start TLS with the node’s certificate. If the node has no certificate yet — while an ACME certificate is on its way — the handshake is refused rather than the conversation continuing without encryption.

4. Sender and recipients

MAIL FROM is refused when:

Each RCPT TO is looked up in the directory: the domain’s tenant, then the address, then groups and aliases.

The addresses dmarc@ and tlsrpt@ are accepted for every hosted domain even when no account has them, so reports your DNS records ask for are not refused.

Guessing at addresses

A sender that tries one address after another, to learn from the replies which exist, is slowed down, then disconnected, and then refused. Each recipient refused for good in one connection counts:

When connections from one network — a /24 for IPv4, a /64 for IPv6 — are closed this way three times within an hour, the network is refused new connections on port 25 for an hour. It is told so before the greeting, and may try again once the hour is over, or sooner if the operator lifts the lock:

421 4.7.0 Too many recipients refused from your network; try again later

Only permanent refusals count, such as 550 5.1.1 No such user here. A temporary one — a suspended tenant, a directory that did not answer — says nothing about whether an address exists, and the sender is right to try it again. A client connecting over IPv6 with an IPv4 address is counted under its own /24. Devices that send without signing in, and your own mailboxes servers and edge nodes, which are known by their certificates, are never counted or refused.

Each network refused this way is one line in the installation’s audit log, with the role receiving, naming the network and until when it is refused. vsx_sessions_closed_total{listener="mx"} counts the connections closed, by reason: harvesting for a connection closed at twenty refusals, network-refused for one refused before its greeting. The refused recipients themselves are in the message trace.

5. The message

The message arrives with DATA or in BDAT chunks.

Line endings are checked strictly because loose handling is how one message can be smuggled inside another. A binary body sent with BDAT and BODY=BINARYMIME is not checked for line endings.

6. Authentication

The server checks the message against the sender’s published records:

The results are written into an Authentication-Results header on the stored message and passed to the filter as a score.

When DMARC fails and the sender’s domain publishes p=reject, the message is refused:

550 5.7.1 Refused by the sender domain's DMARC policy

A message with more than one From header, or whose From header names more than five domains, is refused whatever the domains publish:

550 5.7.1 A message has one From header
550 5.7.1 The From header names more than 5 domains

Every message is also counted towards the aggregate report the sender’s domain asked for, if it asked for one. See Email authentication.

7. Filtering

The filter pipeline scores the message and may decide its fate:

8. Acceptance

The message and its place on the queue are written in one transaction before the server replies:

250 2.0.0 queued as 01K5B7Z3QX9W4M2N8R6T0V1YAC

The 26-character queue id identifies the message in the message trace, in the queue view and in the log. If the store cannot take it, the reply is 451 4.3.0 Storage unavailable; try later.

The server adds a Received header, for example:

Received: from mx.sender.example ([198.51.100.7])
	by mail.example.com with ESMTPS id 01K5B7Z3QX9W4M2N8R6T0V1YAC
	for <alex@example.com>;
	Mon, 14 Sep 2026 12:00:00 +0000

ESMTPS means the message arrived over TLS, ESMTP that it did not. The for line appears when the message has one recipient.

9. Delivery into mailboxes

The relay role hands the message to the deliver role, which for each recipient:

1. Creates the account’s standard mailboxes if they do not exist yet.
2. Runs the account’s active Sieve script, if it has one: filing, flagging, redirecting, rejecting, notifying and replying. See Sieve filters and vacation replies.
3. Files the message: into Junk if the filter tagged it, into Quarantine if it quarantined it, otherwise where the script put it, or Inbox.
4. Sends an out-of-office reply if one is set and the message qualifies.
5. Tells every IMAP IDLE session and JMAP push connection for the account about the new message.

Delivery is one transaction per message, and a message delivered once is not delivered twice if the node restarts part way through.

A recipient that no longer resolves when delivery runs — because the account was deleted in the meantime — is sent back to the sender as undeliverable with 550 5.1.1 mailbox does not exist, when the sender asked for failure notices and passed SPF or DKIM.

Other replies

Watching incoming mail

• vsx_messages_accepted_total{role="mx"} and vsx_messages_refused_total{role="mx",reason="filter"} count messages; see Monitoring.
• vsx_sessions_closed_total{listener="mx"} counts connections closed or refused for guessing at addresses.
• The log line accepted carries the queue id, the number of recipients and the size, and the line filtered carries the verdict, the stage that decided and the score. Neither ever carries message content.
• versealx-server admin get trace tenant=1 address=alex@example.com day=2026-09-14 lists the messages an address received that day, and the ones refused for it.