Deploy ZoneMTA with restricted submission and persistent queues
Prepare MongoDB/Redis dependencies and keep SMTP, HTTP injection, and internal data services from becoming public unauthenticated endpoints.
Reviewed
ZoneMTA is outbound infrastructure, not an incoming mailbox. Its upstream quickstart demonstrates local-only submission without authentication; that is not a configuration to expose on a public address.
For the distinction between outbound delivery and a complete mailbox stack, see ZoneMTA in our Linux mail-server comparison.
Prepare the actual application deployment
- Review the current upstream README and configuration and use compatible maintained Node.js, MongoDB, and Redis versions.
- Start from the documented application-template approach and pin reviewed dependencies/configuration.
- Persist the MongoDB queue/message store and configure required Redis locking/counter access.
- Restrict SMTP submission, HTTP injection, and internal data-channel listeners. Add documented authentication/authorization before any required remote access.
The README distinguishes these services and notes that the optional web administration interface is installed separately. Do not assume an admin UI is bundled or that an application API endpoint is safe merely because it is on a nonstandard port.
Verify before external sending
Check local service health and dependency connectivity. Verify unauthorized network access is denied and a permitted application can submit only according to your sender policy.
Authorize a controlled message only after signing, destination routing, and queue monitoring are ready. Keep production IP reputation and DNS setup separate from process startup. If incoming replies are needed, configure another receiving system explicitly; ZoneMTA’s outbound queue is not an inbox.