Skip to main content

MailProvider

Beta

Being rolled out. The interface described here is the one of the next release: it may still change, and may not be enabled on your tenant yet.

apiVersionmail.stackngo.io/v1alpha1
kindMailProvider
Applied bysng apply or the console (E-mails page)

What it is for​

A MailProvider describes an SMTP account, for example the one of your mail host. The e-mails your tenant sends go out through it. You can declare several (five at most) and attach each MailUser to the provider of your choice.

Encryption is required: port 465 with implicit TLS, or port 587 with STARTTLS. The server must have a public name (no IP address). The password is never in the manifest: it comes from a secret of your tenant.

Minimal example​

provider.yml
apiVersion: mail.stackngo.io/v1alpha1
kind: MailProvider
metadata:
  name: main
spec:
  host: smtp.example.com
  port: 587
  tls:
    mode: starttls
  auth:
    username: notifications@example.com
    passwordSecretRef:
      name: smtp-main
sng apply provider.yml

Complete annotated example​

provider.yml
apiVersion: mail.stackngo.io/v1alpha1
kind: MailProvider
metadata:
  name: main
spec:
  host: smtp.example.com         # public name of the SMTP server
  port: 587                      # 465 (tls.mode: implicit) or 587 (tls.mode: starttls)
  tls:
    mode: starttls
  auth:
    username: notifications@example.com
    passwordSecretRef:           # secret of your tenant; the password is never in the manifest
      name: smtp-main
      key: password              # default: password
  limits:
    perMinute: 30                # messages per minute; 60 by default, 120 at most
  domainAuth:                    # records expected on your senders' domain
    spfInclude: spf.example.com
    dkimSelectors: [mail]

Fields​

MailProvider​

MailProvider : un compte SMTP, seule façon d'ajouter un compte d'envoi.

ChampDescriptionDéfautValidation
apiVersion stringmail.stackngo.io/v1alpha1
kind stringMailProvider
metadata ObjectMetaSeul metadata.name est à renseigner (nom de la ressource dans votre tenant).
spec MailProviderSpec
status MailProviderStatus

MailProviderSpec​

MailProviderSpec : un compte SMTP.

ChampDescriptionDéfautValidation
host stringHost : nom DNS public du serveur SMTP.MaxLength: 253
MinLength: 1
Pattern: ^[A-Za-z0-9]([A-Za-z0-9-]\{0,61\}[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]\{0,61\}[A-Za-z0-9])?)*$
port integerPort du serveur SMTP : 465 (TLS implicite) ou 587 (STARTTLS).Enum: [465 587]
tls MailProviderTLSMode TLS. Le chiffrement est toujours obligatoire.
auth MailProviderAuthIdentifiants de connexion au serveur SMTP.
limits MailProviderLimitsDébit d'envoi maximal de ce fournisseur.Optional: {}
domainAuth MailProviderDomainAuthEnregistrements DNS attendus sur le domaine de vos expéditeurs (SPF, DKIM).Optional: {}

MailProviderStatus​

MailProviderStatus : état observé.

ChampDescriptionDéfautValidation
observedGeneration integerDernière version du manifeste prise en compte par la plateforme.
lastProbeAt TimeDate du dernier test de connexion au serveur SMTP.
lastProbeDurationMs integerLastProbeDurationMs : durée de la dernière sonde.
conditions Condition arrayConditions du fournisseur : SecretResolved, Reachable et Ready.

MailProviderTLS​

MailProviderTLS : mode TLS. Aucune valeur « none » : le TLS est obligatoire.

ChampDescriptionDéfautValidation
mode stringimplicit (port 465) ou starttls (port 587).Enum: [implicit starttls]

MailProviderAuth​

MailProviderAuth : identifiants SMTP. Le mot de passe n'est jamais dans l'objet.

ChampDescriptionDéfautValidation
username stringIdentifiant de connexion SMTP.MaxLength: 254
MinLength: 1
passwordSecretRef PasswordSecretRefSecret de votre tenant qui contient le mot de passe SMTP. Le mot de passe n'apparaît jamais dans le manifeste.

MailProviderLimits​

MailProviderLimits : débit de l'envoi.

ChampDescriptionDéfautValidation
perMinute integerPerMinute : messages par minute (plafonné à 120 pour un tenant).60Minimum: 1

MailProviderDomainAuth​

MailProviderDomainAuth : enregistrements attendus sur le domaine des expéditeurs.

ChampDescriptionDéfautValidation
spfInclude stringSPFInclude : domaine attendu dans le SPF des expéditeurs (include:<valeur>).MaxLength: 253
dkimSelectors string arrayDKIMSelectors : sélecteurs DKIM à vérifier (<sel>._domainkey.<domaine>).MaxItems: 8

PasswordSecretRef​

PasswordSecretRef désigne une clé d'un Secret de votre tenant.

ChampDescriptionDéfautValidation
name stringName du Secret de votre tenant.MaxLength: 253
MinLength: 1
key stringKey dans le Secret.passwordMaxLength: 253
MinLength: 1

Status and conditions​

ConditionMeaning
SecretResolvedThe secret and its key exist
ReachableThe server answers: connection, TLS and authentication succeeded (test without sending)
ReadyBoth above are true: the provider can send

The provider is tested on every change, then regularly. The message of a false condition names the failure category (dns, connect, tls, auth, timeout), never the password or the server's reply. In the console, Test connection runs the test without sending a message.

What happens when you apply​

The provider is tested right away. An attached MailUser can only send once the provider is Ready. Beyond five providers, the most recent ones become Ready=False (reason LimitExceeded).

What happens when you delete​

The attached senders can no longer send. The console and the API refuse to delete a provider that still has senders.

See also​