mail.smtp

The relay connection.

Key	Type	Default
mail.smtp.host	string	localhost
mail.smtp.port	int	25
mail.smtp.tls	string	opportunistic
mail.smtp.server_name	string	empty
mail.smtp.ca_file	string	empty
mail.smtp.insecure_skip_verify	bool	false
mail.smtp.auth	string	none
mail.smtp.username	string	empty
mail.smtp.password	string	empty
mail.smtp.password_file	string	empty
mail.smtp.helo	string	empty
mail.smtp.timeout	duration	15s

host

string, default localhost

The relay hostname or address. Required when mail is enabled.

mail:
  smtp:
    host: "localhost"

port

int, default 25

The relay port: conventionally 25 for a local relay, 587 for submission with STARTTLS, 465 for implicit TLS.

mail:
  smtp:
    port: 25

tls

string, default opportunistic

The transport policy — one of off, opportunistic (default), required, or implicit.

mail:
  smtp:
    tls: "opportunistic"

server_name

string, default empty

Overrides the name the relay’s certificate is verified against. Needed only when Host is an address rather than the name on the certificate.

mail:
  smtp:
    server_name: "smtp.example.com"

ca_file

string, default empty

A PEM bundle to verify the relay’s certificate against, for a relay using a private CA. Empty uses the system trust store.

mail:
  smtp:
    ca_file: "/etc/ssl/certs/internal-ca.pem"

insecure_skip_verify

bool, default false

Disables verification of the relay’s certificate. It turns TLS into obfuscation — an attacker who can redirect the connection can also present their own certificate — so it exists for a lab with a self-signed relay and is warned about at startup.

mail:
  smtp:
    insecure_skip_verify: false

auth

string, default none

Selects the SASL mechanism — one of none (default), auto, plain, login, cram-md5, scram-sha-1, scram-sha-256, or xoauth2. “auto” negotiates the strongest mechanism the relay advertises.

mail:
  smtp:
    auth: "none"

username

string, default empty

The SASL username. Required for every mechanism but none.

mail:
  smtp:
    username: "ssoossh@example.com"

password

string, default empty

The SASL password, or the OAuth2 token for xoauth2. Prefer smtp.password_file: this value is a secret sitting in a config file.

mail:
  smtp:
    password: ""

password_file

string, default empty

Reads the password from a file instead, so the secret can be a mounted file or a systemd credential rather than config text. Takes precedence over Password when both are set. Read once at startup; trailing whitespace is trimmed, since an editor’s newline is never part of the password.

mail:
  smtp:
    password_file: "/run/secrets/ssoossh-smtp-password"

helo

string, default empty

The name announced in the EHLO/HELO greeting. Empty lets go-mail use the local hostname, which is right unless the relay checks it against something specific.

mail:
  smtp:
    helo: "ssoossh.example.com"

timeout

duration, default 15s

Bounds a single delivery’s connect-and-send. It bounds only the background sender, never a request: nothing a browser or an unattended job waits on is behind this.

mail:
  smtp:
    timeout: 15s