Trushilla
Documentation / PowerMTA / Installing PowerMTA 5 on AlmaLinux 9

Installing PowerMTA 5 on AlmaLinux 9

Prepare, install, validate and secure a licensed PowerMTA 5 deployment on AlmaLinux 9.

Cornerstone guideUpdated 2026-07-19By Ilirjan Trushilla

Scope and licensing

PowerMTA is commercial software. Obtain the correct RPM and license from an authorized source before beginning. This guide assumes root access to a clean AlmaLinux 9 host and a legitimate PowerMTA 5.x package.

Security: Do not expose an unauthenticated SMTP listener to the public Internet. Start with loopback or a restricted management network.

Architecture and DNS planning

Plan the server hostname, sending hostnames, source IP addresses, reverse DNS and DKIM selectors before installation. Each source IP should have stable forward and reverse identity.

  • Server hostname resolves to the management IP
  • Every sending IP has provider-assigned PTR
  • HELO names resolve back to their source IP
  • SPF covers the actual envelope-from domain
  • DKIM and DMARC are planned before production traffic

Prepare AlmaLinux

dnf update -y
dnf install -y curl wget bind-utils net-tools policycoreutils-python-utils
hostnamectl set-hostname mta1.example.com
timedatectl set-timezone UTC

Re-login after changing the hostname. Confirm that hostname -f returns the expected fully qualified name and that time synchronization is healthy.

Install the licensed package

Copy the vendor-provided RPM to the server and install it with DNF so dependencies are handled consistently.

dnf install -y ./PowerMTA-5.*.rpm
systemctl daemon-reload
systemctl enable pmta
Production note: Exact package names and installed paths can differ by licensed build. Use rpm -ql on the installed package rather than guessing.

Create a restricted first listener

Begin with a listener reachable only from localhost or a trusted application server. The example below is intentionally minimal and must be adapted to your licensed version and network.

smtp-listener 127.0.0.1:2525

<source 127.0.0.1>
  always-allow-relaying yes
</source>
Version check: Validate directive syntax with the PowerMTA configuration checker supplied by your installation before restarting.

Service validation

systemctl restart pmta
systemctl --no-pager --full status pmta
ss -lntp | grep -E ":(25|2525)\b"
journalctl -u pmta -n 100 --no-pager

Do not continue until the service starts without configuration errors and only the intended interfaces are listening.

Test submission

swaks --server 127.0.0.1:2525 \
  --from [email protected] \
  --to [email protected]

Inspect the transaction, queue state and accounting records. A successful SMTP acceptance does not by itself prove inbox placement.

Firewall and access control

Allow only the ports and source networks actually required. Submission ports should normally require authentication or be limited by network policy.

firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=198.51.100.20/32 port port=2525 protocol=tcp accept"
firewall-cmd --reload

Production checklist

  • License loads successfully
  • Configuration validates
  • Listener access is restricted
  • PTR and HELO align
  • DKIM signing tested
  • SPF and DMARC published
  • Bounce and complaint handling defined
  • Accounting logs retained
  • Monitoring and backups enabled
  • Provider-specific rates begin conservatively

Common failures

Startup failures are most often caused by invalid directives, missing referenced objects, duplicate names, unreadable license files or an IP address that is not assigned locally. Read the first parser error rather than changing multiple lines at once.

Search Trushilla Documentation