Mail transfer agent basics

The pieces of a mail system

A mail transfer agent moves mail between machines over SMTP. A mail delivery agent puts it into a mailbox, and a mail user agent is what a person reads it with. The MTAs to recognise are sendmail — the original, with a famously difficult configuration — Postfix, which is the common default now, exim, which is Debian's traditional choice, and qmail. What the exam mostly wants is that they are interchangeable at the level of the commands below, because every one of them provides a sendmail-compatible interface.

Local mail matters even on a machine nobody emails: cron sends job output to the owner's mailbox, and so do several system services. That is why an unconfigured MTA leaves surprises in /var/mail or /var/spool/mail.

Aliases and forwarding

/etc/aliases maps a local name to somewhere else: another user, a list of users, a file, or a command through a pipe. It is compiled into a database, so an edit does not take effect until newaliases (or sendmail -bi) is run — which is the single most-asked fact on this objective. The conventional entry is root: someone, so that mail to root reaches a person.

The right-hand side is a comma-separated list, and each member of it may be one of five things: a local user, a full address elsewhere, an absolute path to a FILE the message is appended to, a command prefixed with a pipe, or an :include: reference. The leading pipe is the single character that turns a destination into program delivery, so support: |/usr/local/bin/ticket.sh hands the whole message to a ticketing script on its standard input, while the same line without the pipe would append the message to a file of that name. Because a program alias runs code, the delivery agent runs it as an unprivileged account rather than as root.

:include: is the one worth understanding by its TIMING rather than its syntax. The aliases file is compiled into a database and changes nothing until that database is rebuilt, which needs root; an :include: file is opened and parsed on every delivery. So oncall: :include:/var/lib/oncall/members leaves the membership in a file the team lead owns, editable by them, taking effect on the next message, with no administrator and no newaliases in the loop. That is the standard way to delegate a small list.

~/.forward is the user's own version and needs no rebuilding: a single line naming an address forwards everything. Putting the user's own name in it as well, prefixed with a backslash, keeps a local copy — otherwise forwarding replaces delivery.

The queue is inspected with mailq (or sendmail -bp), which lists what is waiting and why. Mail that cannot be delivered is retried for a period and then bounced.

The queue commands are the part that survives changing MTA, and the reason is worth knowing rather than memorising: every one of them installs the same set of names, so /usr/bin/mailq is a link to whatever the installed MTA provides — Postfix on one machine, exim on the next — and the command a candidate types is identical either way. It is an ordinary user command in /usr/bin because reading the queue needs no privilege; flushing it does. newaliases and sendmail are provided the same way, which is why sendmail -bp works on a machine with no sendmail on it.

$ ls -l /usr/bin/mailq... /usr/bin/mailq -> /etc/alternatives/mailq$ mailq-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-A3F19C2A1      512 Mon Aug  3 18:02:11  root@host  (connect to mail.example.com: Connection refused)                                     ops@example.com# sendmail -bp prints the same thing

Queue, mailbox and log are three different places

A message passes through three locations and a question will offer all three as answers. The QUEUE holds what the MTA still owes — /var/spool/mqueue on a sendmail-derived host — and a message leaves it the moment delivery succeeds. The MAILBOX is where the delivery agent wrote it, and for traditional local delivery that is /var/mail/carol for the account carol, with /var/spool/mail the older path that is usually a link to the same directory. The LOG, /var/log/mail.log or /var/log/maillog, only records that the delivery happened; the message is not in it.

The mailbox format matters because it decides whether that is a file or a directory. In mbox the whole mailbox is ONE file, with messages separated by lines beginning From followed by a space — which is why two writers have to lock it, and why a stray line of body text starting with that word has to be escaped. Maildir is the alternative and stores one file per message in a directory such as ~/Maildir, with new, cur and tmp subdirectories, so no locking is needed. Delivery to a user's home directory rather than to /var/mail is a Maildir convention more often than an mbox one.

$ mailqMail queue is empty# nothing owed, so it has already been delivered$ ls -l /var/mail/carol-rw-rw---- 1 carol mail 8214 Aug  3 18:02 /var/mail/carol$ head -1 /var/mail/carolFrom ops@example.com  Mon Aug  3 18:02:11 2026# the mbox separator: From, then a space