# sovite v0.6.0 - Table of Contents

> A modern, secure Mail Transfer Agent written in Elixir/OTP.

## Pages

- [Sovite](readme.md)
- [Sovite Roadmap](roadmap.md)
- [Sovite Structure](structure.md)
- [Configuration](configuration.md)
- [Logging and Telemetry](logging.md)
- [Operations](operations.md)
- [Security Model](security-1.md)
- [Security Policy](security-2.md)

## Modules

- [Sovite.Cluster](Sovite.Cluster.md): A cluster of BEAM nodes over Partisan, without Distributed Erlang.
- [Sovite.Cluster.Joiner](Sovite.Cluster.Joiner.md): Keeps joining known peers (`Sovite.Cluster.Peer`), and reports nodes
coming and going. Start it once `Sovite.Cluster.start/1` returned.
- [Sovite.Cluster.Peer](Sovite.Cluster.Peer.md): Where a cluster node accepts peers: its name, address, and port,
written `name@host:port`.

- Validators
  - [Sovite.Validators](Sovite.Validators.md): Syntax validators for the identifiers that appear in SMTP envelopes.

- IDNA
  - [Sovite.IDNA](Sovite.IDNA.md): Internationalized domain names (IDNA2008, RFC 5890–5893): conversion
between U-labels (`bücher.example`) and A-labels
(`xn--bcher-kva.example`), and their validation.
  - [Sovite.IDNA.CodePoints](Sovite.IDNA.CodePoints.md): The IDNA2008 rules for code points in U-labels: the derived property
of RFC 5892, the contextual rules of its Appendix A, and the Bidi rule
of RFC 5893.
  - [Sovite.IDNA.Punycode](Sovite.IDNA.Punycode.md): Punycode (RFC 3492): encodes a string of Unicode code points as ASCII
letters, digits, and hyphens, for the A-labels of internationalized
domain names (`xn--` followed by the encoding).

- Net
  - [Sovite.Net](Sovite.Net.md): IP address and CIDR network helpers.

- Message
  - [Sovite.Message.AddressList](Sovite.Message.AddressList.md): Rewrites the addresses in an RFC 5322 address list (the value of
`From:`, `To:`, `Cc:`, and similar fields) and keeps every other byte:
display names, comments, groups, and folding.
  - [Sovite.Message.Date](Sovite.Message.Date.md): RFC 5322 §3.3 date-time formatting, as used in `Date:` and `Received:`.

  - [Sovite.Message.Headers](Sovite.Message.Headers.md): The header section of a message (RFC 5322 §2.2), as a list of fields
that keeps every byte of the original, so unchanged fields are passed
through exactly (folding and all), which matters for signatures.
  - [Sovite.Message.MessageID](Sovite.Message.MessageID.md): Builds `Message-ID:` values (RFC 5322 §3.6.4).
  - [Sovite.Message.Received](Sovite.Message.Received.md): Builds `Received:` trace header fields (RFC 5321 §4.4).
  - [Sovite.Message.Trace](Sovite.Message.Trace.md): Trace header fields and the loop checks that read them.

- DNS
  - [Sovite.DNS](Sovite.DNS.md): DNS lookups through a pluggable `Sovite.DNS.Resolver`.

  - [Sovite.DNS.InetRes](Sovite.DNS.InetRes.md): Default `Sovite.DNS.Resolver`, built on OTP's `:inet_res`.
  - [Sovite.DNS.MX](Sovite.DNS.MX.md): Finds the hosts that accept mail for a domain (RFC 5321 §5.1).
  - [Sovite.DNS.Resolver](Sovite.DNS.Resolver.md): Behaviour for DNS resolvers.

- LDAP
  - [Sovite.LDAP](Sovite.LDAP.md): A small layer over OTP's `:eldap`: connecting with StartTLS or LDAPS,
binding, searching, and running all of it in a process of its own.
  - [Sovite.LDAP.Filter](Sovite.LDAP.Filter.md): Parses RFC 4515 LDAP search filters into `:eldap` filters, with
placeholders filled in after parsing.

- SASL
  - [Sovite.SASL](Sovite.SASL.md): SASL authentication (RFC 4422), server and client side.
  - [Sovite.SASL.Backend](Sovite.SASL.Backend.md): Behaviour for credential backends used by `Sovite.SASL.Server`.
  - [Sovite.SASL.Backend.Introspection](Sovite.SASL.Backend.Introspection.md): A `Sovite.SASL.Backend` for `OAUTHBEARER`: checks bearer tokens with
OAuth 2.0 token introspection (RFC 7662) at the identity provider.
  - [Sovite.SASL.Backend.LDAP](Sovite.SASL.Backend.LDAP.md): A `Sovite.SASL.Backend` that checks passwords by binding to an LDAP
directory as the user.
  - [Sovite.SASL.Backend.Static](Sovite.SASL.Backend.Static.md): A `Sovite.SASL.Backend` that reads users from a file, one per line
  - [Sovite.SASL.Dovecot](Sovite.SASL.Dovecot.md): Hands SASL authentication to a Dovecot auth server, over its client
protocol (version 1.2), like Postfix's `smtpd_sasl_type = dovecot`.
  - [Sovite.SASL.Login](Sovite.SASL.Login.md): The `LOGIN` mechanism (draft-murchison-sasl-login): the server asks for
`Username:` then `Password:`. Obsolete, but some clients (older Outlook
versions) offer nothing else. Only safe over TLS.
  - [Sovite.SASL.OAuthBearer](Sovite.SASL.OAuthBearer.md): The `OAUTHBEARER` mechanism (RFC 7628): the client sends an OAuth 2.0
bearer token (RFC 6750) instead of a password.
  - [Sovite.SASL.Password](Sovite.SASL.Password.md): Stored password hashes: creating them and checking passwords against
them.
  - [Sovite.SASL.Plain](Sovite.SASL.Plain.md): The `PLAIN` mechanism (RFC 4616): `[authzid] NUL authcid NUL password`
in one message. Only safe over TLS.
  - [Sovite.SASL.ScramSHA256](Sovite.SASL.ScramSHA256.md): The `SCRAM-SHA-256` mechanism (RFC 5802, RFC 7677).
  - [Sovite.SASL.Server](Sovite.SASL.Server.md): Runs the server side of a SASL exchange against a `Sovite.SASL.Backend`.

- Proxy protocol
  - [Sovite.ProxyProtocol](Sovite.ProxyProtocol.md): The HAProxy PROXY protocol, versions 1 (text) and 2 (binary), which a
proxy or load balancer sends first on a connection to pass on the
original client and server addresses.
  - [Sovite.ProxyProtocol.CRC32C](Sovite.ProxyProtocol.CRC32C.md): CRC-32C (Castagnoli, RFC 3720 / RFC 4960 Appendix B), the checksum of
`PP2_TYPE_CRC32C`. Erlang only has the IEEE CRC-32 built in.

  - [Sovite.ProxyProtocol.Header](Sovite.ProxyProtocol.Header.md): A parsed PROXY protocol header, see `Sovite.ProxyProtocol`.

- Queue
  - [Sovite.Queue.Backoff](Sovite.Queue.Backoff.md): Retry delays for deferred messages (RFC 5321 §4.5.4.1).
  - [Sovite.Queue.Entry](Sovite.Queue.Entry.md): The delivery state of a queued message: its envelope, plus the
`Sovite.Queue.Record`s appended so far, replayed in order.
  - [Sovite.Queue.Envelope](Sovite.Queue.Envelope.md): The envelope of a queued message: who sent it, to whom, and how it
arrived.
  - [Sovite.Queue.ID](Sovite.Queue.ID.md): Queue IDs: 14 characters from `[0-9A-Za-z]`, safe in file names.
  - [Sovite.Queue.Record](Sovite.Queue.Record.md): Delivery records, appended to a queue file after the message by
`Sovite.Queue.Spool.append/3`.
  - [Sovite.Queue.Spool](Sovite.Queue.Spool.md): Durable storage for queued messages.

- Listener
  - [Sovite.Listener](Sovite.Listener.md): A TCP listener with an acceptor pool and connection limits.
  - [Sovite.Listener.Handler](Sovite.Listener.Handler.md): Behaviour for the process that serves one accepted connection.

- SMTP
  - [Sovite.SMTP](Sovite.SMTP.md): SMTP (RFC 5321) building blocks.
  - [Sovite.SMTP.Client](Sovite.SMTP.Client.md): An SMTP client (RFC 5321) for relaying messages to another server.
  - [Sovite.SMTP.Command](Sovite.SMTP.Command.md): Parses SMTP command lines (RFC 5321 §4.1).
  - [Sovite.SMTP.DSNParams](Sovite.SMTP.DSNParams.md): The parameters of the SMTP `DSN` extension (RFC 3461 §4): `NOTIFY` and
`ORCPT` on `RCPT`, `RET` and `ENVID` on `MAIL`.
  - [Sovite.SMTP.DataDecoder](Sovite.SMTP.DataDecoder.md): Streaming decoder for SMTP `DATA` content (RFC 5321 §4.1.1.4, §4.5.2).
  - [Sovite.SMTP.DataEncoder](Sovite.SMTP.DataEncoder.md): Streaming encoder for SMTP `DATA` content, the inverse of
`Sovite.SMTP.DataDecoder`.
  - [Sovite.SMTP.Params](Sovite.SMTP.Params.md): Values of the `MAIL` and `RCPT` parameters of these SMTP extensions
  - [Sovite.SMTP.Reply](Sovite.SMTP.Reply.md): An SMTP reply: a code, an optional enhanced status code (RFC 3463), and
one or more text lines.
  - [Sovite.SMTP.Server](Sovite.SMTP.Server.md): An SMTP server: a `Sovite.Listener` whose connections run
`Sovite.SMTP.Server.Session`.
  - [Sovite.SMTP.Server.Connection](Sovite.SMTP.Server.Connection.md): Runs a `Sovite.SMTP.Server.Session` on an accepted socket. Started by
`Sovite.Listener`; see `Sovite.SMTP.Server` for the public API.
  - [Sovite.SMTP.Server.Handler](Sovite.SMTP.Server.Handler.md): Behaviour for the application side of an SMTP server: policy decisions
and what happens to received messages.
  - [Sovite.SMTP.Server.Session](Sovite.SMTP.Server.Session.md): The SMTP server protocol as a state machine, without I/O.
  - [Sovite.SMTP.XText](Sovite.SMTP.XText.md): The xtext encoding of ESMTP parameter values (RFC 3461 §4): `+` and
`=`, and bytes outside `!`..`~`, are written as `+` and two upper-case
hex digits. Used by `XCLIENT`, `XFORWARD`, and DSN `ORCPT`/`ENVID`.

- TLS
  - [Sovite.TLS](Sovite.TLS.md): TLS settings for mail servers and clients, following BCP 195 (RFC 9325).
  - [Sovite.TLS.ACME](Sovite.TLS.ACME.md): An ACME client (RFC 8555) for getting certificates from a CA such as
Let's Encrypt, with HTTP-01 challenges.
  - [Sovite.TLS.ACME.CSR](Sovite.TLS.ACME.CSR.md): Builds PKCS #10 certificate signing requests (RFC 2986) for ACME: the
first name as the subject's common name, and every name in a
subjectAltName extension request.

  - [Sovite.TLS.ACME.HTTPChallenge](Sovite.TLS.ACME.HTTPChallenge.md): Answers ACME HTTP-01 challenges (RFC 8555 §8.3): a `Sovite.Listener`
handler that serves `GET /.well-known/acme-challenge/<token>` from an
ETS table of `{token, key_authorization}` and answers everything else
with 404.
  - [Sovite.TLS.CertStore](Sovite.TLS.CertStore.md): Holds server certificates, picks one per connection by SNI (RFC 6066),
and reloads them when their files change.
  - [Sovite.TLS.Certificate](Sovite.TLS.Certificate.md): A certificate chain and its private key, loaded from PEM files.
  - [Sovite.TLS.DANE](Sovite.TLS.DANE.md): DANE certificate verification for SMTP (RFC 6698, RFC 7671, RFC 7672).
  - [Sovite.TLS.MTASTS](Sovite.TLS.MTASTS.md): SMTP MTA Strict Transport Security (MTA-STS, RFC 8461).
  - [Sovite.TLS.MTASTS.Policy](Sovite.TLS.MTASTS.Policy.md): An MTA-STS policy (RFC 8461 §3.2), as served at
`https://mta-sts.<domain>/.well-known/mta-sts.txt`.
  - [Sovite.TLS.MTASTS.Server](Sovite.TLS.MTASTS.Server.md): Serves MTA-STS policies (RFC 8461 §3.3): a `Sovite.Listener` handler
for `https://mta-sts.<domain>/.well-known/mta-sts.txt`, with TLS on
the accepted connection.
  - [Sovite.TLS.TLSRPT](Sovite.TLS.TLSRPT.md): SMTP TLS Reporting (TLS-RPT, RFC 8460): finding where a domain wants
its reports, building the JSON report, and sending it.

- Milter
  - [Sovite.Milter](Sovite.Milter.md): A milter client: passes SMTP sessions to a mail filter such as Rspamd,
OpenDKIM, OpenDMARC, or ClamAV-milter over Sendmail's milter protocol
(version 6), with the semantics of Postfix's milter support.
  - [Sovite.Milter.Headers](Sovite.Milter.Headers.md): Applies a milter's header modifications to the header fields of a
message, with libmilter's index rules, and turns fields into the name
and value that `Sovite.Milter.header/3` sends.
  - [Sovite.Milter.Packet](Sovite.Milter.Packet.md): Encodes and decodes milter protocol packets (Sendmail's libmilter,
protocol version 6) in both directions: commands from the MTA, and the
milter's responses. `Sovite.Milter` uses it as the MTA side; a milter
written in Elixir can use it the other way round.

- Policy
  - [Sovite.Policy](Sovite.Policy.md): The Postfix SMTP access policy delegation protocol
(<https://www.postfix.org/SMTPD_POLICY_README.html>), for asking policy
servers such as policyd-spf and postgrey what to do with an SMTP
client, and for writing such servers in Elixir.
  - [Sovite.Policy.Action](Sovite.Policy.Action.md): Policy server actions: the value of the `action` attribute of a reply,
as in a Postfix access(5) table.
  - [Sovite.Policy.Client](Sovite.Policy.Client.md): Asks a policy server what to do, over TCP, a Unix socket, or the
standard input and output of a program.
  - [Sovite.Policy.Handler](Sovite.Policy.Handler.md): Behaviour for a policy server written in Elixir, run by
`Sovite.Policy.Server`.
  - [Sovite.Policy.Server](Sovite.Policy.Server.md): A policy server: a `Sovite.Listener` whose connections speak the policy
delegation protocol, with the decisions made by a
`Sovite.Policy.Handler`.

- Abuse
  - [Sovite.Abuse.Cache](Sovite.Abuse.Cache.md): A small in-memory cache with per-entry expiry, for example to remember
clients that passed anti-abuse checks.
  - [Sovite.Abuse.DNSBL](Sovite.Abuse.DNSBL.md): Scores a client address or a domain against DNS block and allow lists
(RFC 5782): IP lists (DNSBL, DNSWL) and domain lists (RHSBL).
  - [Sovite.Abuse.Greylist](Sovite.Abuse.Greylist.md): Greylisting decisions, in the style of postgrey.
  - [Sovite.Abuse.Penalty](Sovite.Abuse.Penalty.md): Counts failures per key (for example failed logins per client address)
and bans a key for a while after too many of them.
  - [Sovite.Abuse.RateLimit](Sovite.Abuse.RateLimit.md): Counts events per key over sliding windows, for limits such as "100
messages per hour per client address".
  - [Sovite.Abuse.ReverseDNS](Sovite.Abuse.ReverseDNS.md): Reverse DNS of a client address, and whether the forward lookup of the
name confirms it (forward-confirmed reverse DNS, FCrDNS).

- Email authentication
  - [Sovite.ARC](Sovite.ARC.md): Authenticated Received Chain (RFC 8617): verifying the chain of ARC
sets a message carries, and sealing it with one more, so the
authentication results of earlier hops survive forwarding and mailing
lists.
  - [Sovite.ARC.Result](Sovite.ARC.Result.md): The chain validation result. `instance` is the highest instance
(0 without a chain), `sealers` the `d=` of each `ARC-Seal:`, oldest
first.

  - [Sovite.AuthResults](Sovite.AuthResults.md): The `Authentication-Results:` header field (RFC 8601), which tells the
next hop and the user's mail client what this server found out about
a message
  - [Sovite.DKIM](Sovite.DKIM.md): DKIM signing and verification (RFC 6376), with RSA-SHA256 and
Ed25519-SHA256 (RFC 8463). RSA-SHA1 signatures and RSA keys shorter
than 1024 bits are never accepted (RFC 8301).
  - [Sovite.DKIM.Body](Sovite.DKIM.Body.md): Body hashes (RFC 6376 §3.4.3, §3.4.4, §3.7), computed while the body
streams by, for any number of signatures at once.
  - [Sovite.DKIM.Canon](Sovite.DKIM.Canon.md): Header canonicalization (RFC 6376 §3.4.1 and §3.4.2), and the header
data a signature covers (§3.7, §5.4.2).
  - [Sovite.DKIM.Key](Sovite.DKIM.Key.md): DKIM public keys: the key records published at
`<selector>._domainkey.<domain>` (RFC 6376 §3.6.1), and the signature
algorithms that use them.
  - [Sovite.DKIM.Result](Sovite.DKIM.Result.md): The outcome for one signature. `b` is the start of the signature, to
tell signatures apart in `Authentication-Results:` (`header.b`, RFC
6008).

  - [Sovite.DKIM.Signature](Sovite.DKIM.Signature.md): A parsed `DKIM-Signature:` field (RFC 6376 §3.5), or the
`ARC-Message-Signature:` field that uses the same tags (RFC 8617 §4.1.2).

  - [Sovite.DKIM.SigningKey](Sovite.DKIM.SigningKey.md): A private key to sign with, for one domain and selector, and the key
record to publish for it.
  - [Sovite.DKIM.Tags](Sovite.DKIM.Tags.md): DKIM tag lists (RFC 6376 §3.2): `tag=value` pairs separated by `;`,
as used by `DKIM-Signature:` fields, key records, and the ARC fields.
  - [Sovite.DKIM.Verifier](Sovite.DKIM.Verifier.md): Verifies the `DKIM-Signature:` fields of a message whose body is
hashed as it streams by (RFC 6376 §6).
  - [Sovite.DMARC](Sovite.DMARC.md): DMARC (RFC 7489): checks that the domain in a message's `From:` field
is the one SPF or DKIM authenticated, and finds what its owner asks
receivers to do with mail that fails.
  - [Sovite.DMARC.Policy](Sovite.DMARC.Policy.md): A discovered DMARC policy: the record, the domain it was found at
(the From domain or one of its parents), and the From domain's
Organizational Domain. See `Sovite.DMARC.discover/2`.

  - [Sovite.DMARC.Record](Sovite.DMARC.Record.md): A DMARC policy record (RFC 7489 §6.3), as published in TXT at
`_dmarc.<domain>`.
  - [Sovite.DMARC.Report](Sovite.DMARC.Report.md): DMARC aggregate reports (RFC 7489 §7.2 and Appendix C, with the
`<version>` and `<np>` elements of the DMARCbis aggregate reporting
draft).
  - [Sovite.DMARC.Result](Sovite.DMARC.Result.md): The outcome of `Sovite.DMARC.check/3`.
  - [Sovite.SPF](Sovite.SPF.md): SPF verification (RFC 7208).
  - [Sovite.SPF.Macro](Sovite.SPF.Macro.md): SPF macro strings (RFC 7208 §7).
  - [Sovite.SPF.Record](Sovite.SPF.Record.md): Parses SPF records (RFC 7208 §4.5, §12).
  - [Sovite.SPF.Result](Sovite.SPF.Result.md): The outcome of an SPF check.
  - [Sovite.SRS](Sovite.SRS.md): The Sender Rewriting Scheme, so forwarded mail still passes SPF: the
envelope sender is rewritten into an address at the forwarder's own
domain, and bounces to that address are turned back into the original
sender.

- Local delivery
  - [Sovite.Maildir](Sovite.Maildir.md): Delivers messages into Maildir folders (https://cr.yp.to/proto/maildir.html).
  - [Sovite.Pipe](Sovite.Pipe.md): Runs an external command with a file as its standard input, for
delivery to programs such as `procmail`, `dovecot-lda`, or a list
manager.

- DSN
  - [Sovite.DSN](Sovite.DSN.md): Builds delivery status notifications (RFC 3464), the messages that tell
a sender their mail was not delivered (or not yet), or was delivered
when they asked to know (DSN, RFC 3461).

- Metrics
  - [Sovite.Metrics](Sovite.Metrics.md): Metrics computed from `:telemetry` events and kept in memory, for
export in the Prometheus text format with `Sovite.Metrics.Prometheus`.
  - [Sovite.Metrics.Metric](Sovite.Metrics.Metric.md): A metric definition, built by `Sovite.Metrics.counter/2`,
`Sovite.Metrics.sum/2`, `Sovite.Metrics.last_value/2` or
`Sovite.Metrics.distribution/2`. See `Sovite.Metrics` for the options.

  - [Sovite.Metrics.Prometheus](Sovite.Metrics.Prometheus.md): Encodes metric families, as `Sovite.Metrics.collect/1` returns them, in
the Prometheus text exposition format, version 0.0.4.

- Tracing
  - [Sovite.Tracing](Sovite.Tracing.md): OpenTelemetry traces built from `:telemetry` events, exported to a
collector with OTLP/HTTP and JSON.

- Systemd
  - [Sovite.Systemd](Sovite.Systemd.md): The systemd service manager protocol, without libsystemd: readiness and
status notifications (sd_notify(3)), the watchdog (sd_watchdog_enabled(3),
see `Sovite.Systemd.Watchdog`), and socket activation (sd_listen_fds(3)).
  - [Sovite.Systemd.Watchdog](Sovite.Systemd.Watchdog.md): Sends the systemd watchdog ping (`WATCHDOG=1`) every half watchdog
interval, for units with `WatchdogSec=`.

- Core
  - [Sovite](Sovite.md): Sovite, a Mail Transfer Agent written in Elixir/OTP.
  - [Sovite.Core.ACME](Sovite.Core.ACME.md): Keeps an ACME certificate (`[tls.acme]`) issued and renewed.
  - [Sovite.Core.Bounce](Sovite.Core.Bounce.md): The bounce service: tells senders about failed and delayed delivery,
and about successful delivery when they ask for it (DSN, RFC 3461).
  - [Sovite.Core.CLI](Sovite.Core.CLI.md): The `sovitectl` command line.
  - [Sovite.Core.Cluster](Sovite.Core.Cluster.md): Runs Sovite as one node of a cluster (`[cluster]`), over
`Sovite.Cluster` (Partisan, with mutual TLS).
  - [Sovite.Core.Cluster.Placement](Sovite.Core.Cluster.Placement.md): Which node of a cluster delivers what (see "Handing mail to another
node" in `Sovite.Core.Cluster.Queue`): `place/3` decides for the
routes of a message, and `hand_over/2` hands a delivery job to
another node, from a delivery worker.

  - [Sovite.Core.Cluster.Queue](Sovite.Core.Cluster.Queue.md): The queues of a cluster's nodes. Each node delivers the mail in its
own spool (`queue.directory`); this process keeps copies of it on
other nodes, hands mail to the node that should send it, and hands a
node's queue to the others when it leaves.
  - [Sovite.Core.Cluster.SharedConfig](Sovite.Core.Cluster.SharedConfig.md): The configuration the nodes of a cluster share: a TOML file, the same
on every node, under each node's own config file.
  - [Sovite.Core.Cluster.Sync](Sovite.Core.Cluster.Sync.md): Shares anti-abuse state between the nodes of a cluster, so that limits
hold for the cluster as a whole
  - [Sovite.Core.Config](Sovite.Core.Config.md): Loads, validates, and stores the Sovite configuration file.
  - [Sovite.Core.Config.Error](Sovite.Core.Config.Error.md): A single configuration problem.
  - [Sovite.Core.Config.Settings](Sovite.Core.Config.Settings.md): The settings of a config file as `key = value` lines, like Postfix's
`postconf`: every key of the schema, with its value from the file or its
default. Keys are dotted paths (`smtp.max_message_size`), with array
indexes for tables that repeat (`listener[0].port`). Values are TOML.
  - [Sovite.Core.Control](Sovite.Core.Control.md): Runs the MTA as a whole: reloads the configuration, drains the server
before it stops, and reports its status. Started last by
`Sovite.Core.Supervisor`, so it stops first.
  - [Sovite.Core.DMARCReports](Sovite.Core.DMARCReports.md): Sends DMARC aggregate reports (RFC 7489 §7.2), when `dmarc.reports` is
on.
  - [Sovite.Core.Delivery](Sovite.Core.Delivery.md): Delivers one job (a message to a group of recipients with the same
destination). Runs in a task started by `Sovite.Core.QueueManager`.
  - [Sovite.Core.Greylist](Sovite.Core.Greylist.md): Built-in greylisting (`[greylist]`), with `Sovite.Abuse.Greylist`
deciding and the `greylist_entries` table remembering.
  - [Sovite.Core.IPPools](Sovite.Core.IPPools.md): Outbound IP pools (`[[ip_pool]]`): the source addresses mail goes out
from, with warm-up schedules and daily limits.
  - [Sovite.Core.LogReader](Sovite.Core.LogReader.md): Reads Sovite's own log lines back, for `sovitectl trace` and
`sovitectl report`.
  - [Sovite.Core.LogReport](Sovite.Core.LogReport.md): A summary of mail traffic from the logs, in the style of Postfix's
`pflogsumm`, for `sovitectl report`.
  - [Sovite.Core.Logging](Sovite.Core.Logging.md): Configures logging from the `[log]` config section.
  - [Sovite.Core.Logging.FileHandler](Sovite.Core.Logging.FileHandler.md): `:logger` handler that writes to rotating log files, in the style of
pino-roll.
  - [Sovite.Core.Logging.JSONFormatter](Sovite.Core.Logging.JSONFormatter.md): `:logger` formatter that writes one JSON object per line.
  - [Sovite.Core.Logging.SyslogHandler](Sovite.Core.Logging.SyslogHandler.md): `:logger` handler that sends log lines to a syslog daemon: to a local
socket such as `/dev/log` (journald, rsyslog, syslog-ng), or over UDP
to a remote host.
  - [Sovite.Core.Lookup](Sovite.Core.Lookup.md): The interface routing uses to read Sovite's database tables
(`Sovite.Core.Repo.Tables.*`): a key goes in, a string value or nothing
comes out.
  - [Sovite.Core.MTASTS](Sovite.Core.MTASTS.md): Finds the MTA-STS policies (RFC 8461) of the domains Sovite delivers
to, when `mta_sts.enabled` is on. `Sovite.Core.Delivery` applies them.
  - [Sovite.Core.MailAuth](Sovite.Core.MailAuth.md): Email authentication for `Sovite.Core.SMTPHandler`: SPF, DKIM, ARC,
and DMARC on mail from outside, DKIM signing on mail from users, and
ARC sealing on mail this server forwards.
  - [Sovite.Core.Metrics](Sovite.Core.Metrics.md): The Prometheus metrics of the MTA, served at `/metrics` on the admin
server (see `Sovite.Core.Web`) with `metrics.enabled`.
  - [Sovite.Core.Milters](Sovite.Core.Milters.md): The mail filters (`[[milter]]`) of an SMTP session, such as Rspamd,
OpenDKIM, OpenDMARC, or ClamAV-milter, run with `Sovite.Milter` as
Postfix runs `smtpd_milters`.
  - [Sovite.Core.Outbound](Sovite.Core.Outbound.md): Outbound abuse protection (`[outbound]`): detects accounts that are
probably compromised, from how much of the mail they send fails.
  - [Sovite.Core.PolicyService](Sovite.Core.PolicyService.md): `check_policy_service ADDRESS` in the restriction chains: asks a
Postfix policy server (https://www.postfix.org/SMTPD_POLICY_README.html)
such as postgrey or policyd-spf, with `Sovite.Policy.Client`.
  - [Sovite.Core.Postfix.MainCf](Sovite.Core.Postfix.MainCf.md): Reads Postfix's `main.cf` and expands parameter values the way Postfix
does, for `Sovite.Core.Postfix.Migration`.
  - [Sovite.Core.Postfix.MasterCf](Sovite.Core.Postfix.MasterCf.md): Reads Postfix's `master.cf`, for `Sovite.Core.Postfix.Migration`.
  - [Sovite.Core.Postfix.Migration](Sovite.Core.Postfix.Migration.md): Turns a Postfix configuration into a Sovite one, for
`sovitectl migrate postfix`.
  - [Sovite.Core.Postfix.Table](Sovite.Core.Postfix.Table.md): Reads Postfix lookup tables, for `Sovite.Core.Postfix.Migration`.
  - [Sovite.Core.Postfix.TomlWriter](Sovite.Core.Postfix.TomlWriter.md): Writes the TOML of a generated config file, for
`Sovite.Core.Postfix.Migration`. Only what a Sovite config needs:
strings, integers, booleans, arrays of those, inline tables, tables,
and arrays of tables, with comments.

  - [Sovite.Core.QueueInfo](Sovite.Core.QueueInfo.md): Reads the queue directory for `sovitectl queue` and the admin API:
lists of queued messages, and the details of one. Everything returned
is plain maps, strings, and numbers, ready to be encoded as JSON.
  - [Sovite.Core.QueueManager](Sovite.Core.QueueManager.md): Schedules queued messages for delivery, like Postfix's `qmgr`.
  - [Sovite.Core.Recipients](Sovite.Core.Recipients.md): Recipient expansion and validation.
  - [Sovite.Core.Repo](Sovite.Core.Repo.md): Sovite's database, through Ecto.
  - [Sovite.Core.Repo.Schemas.AccessRule](Sovite.Core.Repo.Schemas.AccessRule.md): An access rule for the restriction chains (`Sovite.Core.Restrictions`):
when the client address, `EHLO` name, sender, or recipient (`kind`)
matches `pattern`, take `action` (`ACCEPT`, `CONTINUE`, `REJECT`,
`DEFER`, `DISCARD`, `HOLD`, `WARN`, or a `4NN`/`5NN` reply code) with
optional `text`.

  - [Sovite.Core.Repo.Schemas.AddressRewrite](Sovite.Core.Repo.Schemas.AddressRewrite.md): An address rewrite: addresses matching `pattern` (a full address,
`@domain`, or a local part) become `replacement` (a full address,
`@domain` to change only the domain, or a local part to change only the
local part). `kind` says which addresses: `:sender`, `:recipient`, or
`:both`.

  - [Sovite.Core.Repo.Schemas.Alias](Sovite.Core.Repo.Schemas.Alias.md): An alias: mail for `address` goes to its destinations instead.
`address` is a full address, `@domain` (every address of the domain
that has no alias of its own), or a bare local part (for local domains).

  - [Sovite.Core.Repo.Schemas.AliasDestination](Sovite.Core.Repo.Schemas.AliasDestination.md): One address an alias delivers to.
  - [Sovite.Core.Repo.Schemas.BccRule](Sovite.Core.Repo.Schemas.BccRule.md): A BCC rule: messages whose sender (`kind: :sender`) or one of whose
recipients (`kind: :recipient`) matches `pattern` (a full address, or
`@domain`) are also sent to `address`.

  - [Sovite.Core.Repo.Schemas.DMARCReportEntry](Sovite.Core.Repo.Schemas.DMARCReportEntry.md): The DMARC evaluation of one received message, kept until the next
aggregate report for its policy domain (`Sovite.Core.DMARCReports`).

  - [Sovite.Core.Repo.Schemas.DMARCSignature](Sovite.Core.Repo.Schemas.DMARCSignature.md): One DKIM signature result of a `Sovite.Core.Repo.Schemas.DMARCReportEntry`,
stored inside it.

  - [Sovite.Core.Repo.Schemas.Domain](Sovite.Core.Repo.Schemas.Domain.md): A domain this server handles, and its class (see
`Sovite.Core.Routing`): `:local`, `:aliased`, `:hosted`, or `:relay`.

  - [Sovite.Core.Repo.Schemas.GreylistEntry](Sovite.Core.Repo.Schemas.GreylistEntry.md): A greylisting triplet (client network, sender, recipient), see
`Sovite.Abuse.Greylist`: when it was first and last seen, and when it
passed. Deleted after `expires_at`.

  - [Sovite.Core.Repo.Schemas.IPAddressCount](Sovite.Core.Repo.Schemas.IPAddressCount.md): How many messages went out from one source address of an IP pool on
one day (UTC), for warm-up schedules and daily limits, see
`Sovite.Core.IPPools`.

  - [Sovite.Core.Repo.Schemas.MTASTSPolicy](Sovite.Core.Repo.Schemas.MTASTSPolicy.md): The cached MTA-STS policy of a domain Sovite delivers to (RFC 8461
§5.1), kept by `Sovite.Core.MTASTS` until `expires_at`.

  - [Sovite.Core.Repo.Schemas.Mailbox](Sovite.Core.Repo.Schemas.Mailbox.md): A mailbox in a virtual mailbox domain: `address`, or `@domain` to
accept every address of the domain.

  - [Sovite.Core.Repo.Schemas.RelocatedUser](Sovite.Core.Repo.Schemas.RelocatedUser.md): A user who moved: mail for `address` is rejected with `5.1.6` and
`new_location` (usually the new address).

  - [Sovite.Core.Repo.Schemas.SenderLogin](Sovite.Core.Repo.Schemas.SenderLogin.md): A sender address a user may use in `MAIL FROM`: a full address
(`sales@example.com`), every address at a domain (`@example.com`), or
any address (`*`).

  - [Sovite.Core.Repo.Schemas.SenderRelay](Sovite.Core.Repo.Schemas.SenderRelay.md): How mail from `sender` (an address, or `@domain`) leaves: through
`relayhost`, from `source_address`, logging in with `username` and
`password`. Each part is optional.
  - [Sovite.Core.Repo.Schemas.TLSReportEntry](Sovite.Core.Repo.Schemas.TLSReportEntry.md): The TLS outcome of one outgoing SMTP session to a domain's MX host,
kept until the next TLS-RPT report (RFC 8460) for the domain
(`Sovite.Core.TLSReports`).

  - [Sovite.Core.Repo.Schemas.Transport](Sovite.Core.Repo.Schemas.Transport.md): A transport map entry: mail for `pattern` (an address, a domain,
`.domain` for its subdomains, or `*`) goes through `transport`, a
`Sovite.Core.Transport` specification.

  - [Sovite.Core.Repo.Schemas.User](Sovite.Core.Repo.Schemas.User.md): A user who can authenticate (SMTP AUTH), with the sender addresses
they may use.

  - [Sovite.Core.Repo.Tables.AccessRules](Sovite.Core.Repo.Tables.AccessRules.md): Access rules for the restriction chains, stored in Sovite's database
and managed with `sovitectl access`.
  - [Sovite.Core.Repo.Tables.AddressRewrites](Sovite.Core.Repo.Tables.AddressRewrites.md): Address rewrites stored in Sovite's database, managed with `sovitectl
rewrite` (see `Sovite.Core.Rewrite`).
  - [Sovite.Core.Repo.Tables.Aliases](Sovite.Core.Repo.Tables.Aliases.md): Aliases stored in Sovite's database, managed with `sovitectl alias`.
  - [Sovite.Core.Repo.Tables.BccRules](Sovite.Core.Repo.Tables.BccRules.md): BCC rules stored in Sovite's database, managed with `sovitectl bcc`
(see `Sovite.Core.Recipients.bcc/3`).
  - [Sovite.Core.Repo.Tables.DMARCReportEntries](Sovite.Core.Repo.Tables.DMARCReportEntries.md): DMARC evaluations waiting to be reported, one per message, written by
`Sovite.Core.SMTPHandler` and read and removed by
`Sovite.Core.DMARCReports` when it sends the aggregate reports.

  - [Sovite.Core.Repo.Tables.DomainCache](Sovite.Core.Repo.Tables.DomainCache.md): Keeps the domains of `Sovite.Core.Repo.Tables.Domains` in `:persistent_term`, so
every recipient check can read them without a database query.
  - [Sovite.Core.Repo.Tables.Domains](Sovite.Core.Repo.Tables.Domains.md): Domains stored in Sovite's database, managed with `sovitectl domain`.
They add to the domains in the `[domains]` config section; a domain in
the config file wins over the same domain in the database.
  - [Sovite.Core.Repo.Tables.GreylistEntries](Sovite.Core.Repo.Tables.GreylistEntries.md): The greylisting triplets seen by `Sovite.Core.Greylist`: one per
client network, sender, and recipient.

  - [Sovite.Core.Repo.Tables.IPAddressCounts](Sovite.Core.Repo.Tables.IPAddressCounts.md): Messages sent per source address and day, for the warm-up schedules
and daily limits of `Sovite.Core.IPPools`.

  - [Sovite.Core.Repo.Tables.MTASTSPolicies](Sovite.Core.Repo.Tables.MTASTSPolicies.md): The MTA-STS policies of recipient domains, cached by
`Sovite.Core.MTASTS`: one per domain.

  - [Sovite.Core.Repo.Tables.Mailboxes](Sovite.Core.Repo.Tables.Mailboxes.md): Mailboxes of virtual mailbox domains, stored in Sovite's database and
managed with `sovitectl mailbox`.
  - [Sovite.Core.Repo.Tables.RelocatedUsers](Sovite.Core.Repo.Tables.RelocatedUsers.md): Users who moved, stored in Sovite's database and managed with
`sovitectl moved`. Mail for them is rejected with `5.1.6` and
their new location.
  - [Sovite.Core.Repo.Tables.SenderRelays](Sovite.Core.Repo.Tables.SenderRelays.md): Sender-dependent relaying, stored in Sovite's database and managed
with `sovitectl sender-relay`: for a sender address or `@domain`, the
relay host, the source address to connect from, and the credentials
for the relay host.
  - [Sovite.Core.Repo.Tables.TLSReportEntries](Sovite.Core.Repo.Tables.TLSReportEntries.md): TLS outcomes of outgoing sessions waiting to be reported, one per
session, written by `Sovite.Core.Delivery` and read and removed by
`Sovite.Core.TLSReports` when it sends the TLS-RPT reports.

  - [Sovite.Core.Repo.Tables.Transports](Sovite.Core.Repo.Tables.Transports.md): Transports stored in Sovite's database, managed with
`sovitectl transport`.
  - [Sovite.Core.Repo.Tables.Users](Sovite.Core.Repo.Tables.Users.md): Users stored in Sovite's database (`Sovite.Core.Repo`), and a
`Sovite.SASL.Backend` that authenticates against them.
  - [Sovite.Core.Restrictions](Sovite.Core.Restrictions.md): Restriction chains (`[restrictions]`): lists of checks run at each
stage of an SMTP session.
  - [Sovite.Core.Rewrite](Sovite.Core.Rewrite.md): Address rewriting.
  - [Sovite.Core.RouteInfo](Sovite.Core.RouteInfo.md): Shows how the routing tables resolve an address, for `sovitectl route`
and the admin API: the steps a recipient goes through when it is
received (`Sovite.Core.Rewrite`, `Sovite.Core.Recipients`) and when it
is delivered (`Sovite.Core.Router`).
  - [Sovite.Core.Router](Sovite.Core.Router.md): Decides, at delivery time, where each recipient's mail goes.
  - [Sovite.Core.Routing](Sovite.Core.Routing.md): The routing configuration (`[domains]`, `[routing]`, and the next-hop
settings of `[delivery]`) together with Sovite's routing tables in the
database, and the address helpers shared by rewriting
(`Sovite.Core.Rewrite`), recipient expansion (`Sovite.Core.Recipients`),
and next-hop selection (`Sovite.Core.Router`).
  - [Sovite.Core.SMTPHandler](Sovite.Core.SMTPHandler.md): The MTA's `Sovite.SMTP.Server.Handler`: relay control, restrictions,
authentication, recipient checks and expansion, and durable spooling.
  - [Sovite.Core.Screen](Sovite.Core.Screen.md): Anti-abuse checks of SMTP clients, run by `Sovite.Core.SMTPHandler`
before its own checks of each stage. Clients in
`smtp.trusted_networks` skip all of them.
  - [Sovite.Core.SenderCheck](Sovite.Core.SenderCheck.md): Sender login maps: which `MAIL FROM` addresses an authenticated user
may use.
  - [Sovite.Core.Sendmail](Sovite.Core.Sendmail.md): The `sendmail(1)`, `mailq(1)`, and `newaliases(1)` commands, for local
programs and cron jobs that expect them.
  - [Sovite.Core.Supervisor](Sovite.Core.Supervisor.md): Root supervisor of the Sovite MTA.
  - [Sovite.Core.TLSReports](Sovite.Core.TLSReports.md): Sends TLS-RPT reports (RFC 8460), when `tls_rpt.reports` is on.
  - [Sovite.Core.Telemetry](Sovite.Core.Telemetry.md): The catalog of `:telemetry` events emitted by Sovite, and the default
handler that turns them into log lines.
  - [Sovite.Core.Tenants](Sovite.Core.Tenants.md): Tenants (`[[tenant]]`), for hosting the mail of several customers on
one server or cluster, each with its own limits, signing keys, and
outbound IP pool.
  - [Sovite.Core.Trace](Sovite.Core.Trace.md): Follows a message through the logs, from the connection it came in on
to its final delivery, for `sovitectl trace`.
  - [Sovite.Core.Tracing](Sovite.Core.Tracing.md): The OpenTelemetry traces of the MTA, sent with `tracing.enabled` to the
OTLP/HTTP collector at `tracing.endpoint` (`Sovite.Tracing`).
  - [Sovite.Core.Transport](Sovite.Core.Transport.md): Transport specifications: `transport:nexthop`.
  - [Sovite.Core.Web](Sovite.Core.Web.md): The web server: the status UI and the admin API, served with Plug and
Cowboy on `admin.address` and `admin.port` (`127.0.0.1:9025` by
default), with TLS from the certificate store when `admin.tls` is set.
  - [Sovite.Core.Web.API](Sovite.Core.Web.API.md): The admin API, under `/api` on the web server (`Sovite.Core.Web`),
for `sovitectl`, monitoring, and the UI. Every request needs the token
from `admin.token_file`

## Mix Tasks

- [mix dev](Mix.Tasks.Dev.md): Runs the MTA (as `mix dev.mta`) and the web UI's Vite dev server (`bun
dev` in `lib/core/sovite_web`) together, for development.
- [mix dev.mta](Mix.Tasks.Dev.Mta.md): Runs the MTA on this machine, for development.

