Defining listeners

KumoMTA exposes one or more SMTP listeners. Each can have its own ports, TLS, AUTH, and accept rules.

kumo.on('init', function()
  -- Inbound relay (from your application)
  kumo.start_esmtp_listener {
    listen = '0.0.0.0:587',
    relay_hosts = { '127.0.0.1', '10.0.0.0/8' },
    tls_certificate = '/etc/ssl/kumo/fullchain.pem',
    tls_private_key  = '/etc/ssl/kumo/privkey.pem',
  }

  -- Submission with AUTH from public clients
  kumo.start_esmtp_listener {
    listen = '0.0.0.0:465',
    tls_certificate = '/etc/ssl/kumo/fullchain.pem',
    tls_private_key  = '/etc/ssl/kumo/privkey.pem',
    -- Implicit TLS:
    invocation = 'implicit_tls',
  }
end)

relay_hosts is the trusted-network shortcut. Hosts in this list can send to any recipient without AUTH. For public-facing submission, leave it empty and require AUTH.

Multiple listeners are normal — usually one for application traffic (no auth, IP-restricted) and one for external submission (auth required).