Known issues

DKIM signing and the USE_RELAY=true sender check were fixed and tested with KumoMTA 2026.09.29, with keys from a file, an HTTP service and Redis. These problems remain.

Traffic shaping is not loaded

shaping.toml has rules for Google, Microsoft, Yahoo, Apple and others, but nothing loads it. KumoMTA only reads shaping files through the get_egress_path_config event, and init.lua does not register one. Only the per-domain message rate in queue.lua applies.

To load it, use the shaping helper:

local shaping = require 'policy-extras.shaping'
 
local shaper = shaping:setup_with_automation {
  publish = { 'http://127.0.0.1:8008' },
  subscribe = { 'http://127.0.0.1:8008' },
  extra_files = { '/opt/kumomta/etc/policy/shaping.toml' },
}
 
kumo.on('init', function()
  shaper.setup_publish()
end)
 
kumo.on('get_egress_path_config', shaper.get_egress_path_config)

The automation rules in shaping.toml (for example "slow down after a 421 from Gmail") also need KumoMTA's TSA daemon, tsa-daemon, which is a separate process. The outbound container only runs kumod, so add a second service or process that runs tsa-daemon with a tsa_init.lua. See Traffic shaping automation in the KumoMTA docs.

Smaller issues

• Unused values in queue.lua. The conns and per_conn values are calculated for each domain but never used. Connection limits belong in the shaping file.
• Two lists of domains. domains.lua and listener_domains.toml hold the same domains. Keep one source of truth.
• WEBHOOK_SECRET is not sent. webhook.lua reads it but does not add it to the request, so a receiver cannot verify the sender.
• Plain-text passwords in users.lua.