PowerMTA is powerful and unforgiving. Its per-VMTA policy model lets you serve completely different sending profiles from a single instance, but it does not warn you when you have configured a queue in a way that will produce defers, retries and eventual reputation loss.
VMTA topology
Design VMTAs around sending profile, not around campaign structure. A VMTA per IP per stream is a reasonable starting point. Route by target domain when the profile at Gmail differs materially from the profile at Microsoft. Do not attempt to route by campaign — that is a data-plane concern, handled through tagging, not through VMTA proliferation.
Per-domain policy
Use the <domain> blocks to tune connection concurrency, connection reuse, and back-off behaviour per receiving domain. Gmail and Outlook have different sweet spots. Yahoo has different sensitivities. Corporate O365 tenants often need lower concurrency than public Outlook.
Bounce classification
PowerMTA's bounce categoriser is one of its principal advantages. Configure the bounce-categoriser section carefully, then pipe categorised bounces to your downstream systems (suppression, analytics, alerting). Do not swallow bounces silently; a message that bounced with 'bad-mailbox' is very different from one that bounced with 'block-listing'.
Accounting logs
Accounting logs are the source of truth for volume, defers, bounces and complaints. Ship them to a log store (ClickHouse, Splunk, S3+Athena) rather than trying to grep them on the node. Retain them for the life of the account.
Common misconfigurations
- Single-VMTA configurations that mix transactional and marketing on the same queue and outbound IP
- Aggressive retry intervals that turn a temporary defer into a rate-limit-inducing storm
- Global concurrency that does not respect per-domain limits
- Missing or wrong DKIM signing selector per VMTA
Related articles
- SPF ExplainedHow Sender Policy Framework works, how to author a record correctly, and how to avoid the common failure modes.
- DKIM ExplainedDomainKeys Identified Mail — how signing works, selector strategy, key length and rotation, and what DKIM cannot do.
- DMARC GuideHow DMARC ties SPF and DKIM together, staged policy rollout from monitor to reject, and how to use aggregate reports.
- Google Postmaster GuideHow to set up Postmaster Tools, what each metric means, and how to interpret the reputation graph.
- IP Warm-upHow to warm a new IP without wasting weeks or torching reputation. Volume curves, segmentation, and when to stop.
- Dedicated vs Shared IPWhen each is appropriate, the volume thresholds that make dedicated worthwhile, and the myths on both sides.