Key Takeaways

• msmtprc is a lightweight SMTP client configuration file used by msmtp, msmtp-mta, and msmtp-mta replacement tools.
• It allows per‑user or system‑wide routing of outgoing mail, authentication, and TLS settings in a single, human‑readable file.
• Properly configuring msmtprc improves deliverability, reduces spam flags, and simplifies maintenance across multiple mail clients.
• Security best practices include file permissions, SMTP authentication via OAuth2 or app passwords, and TLS enforcement.
• msmtprc is ideal for embedded systems, containerized environments, and low‑resource servers where full MTA packages are unnecessary.

What is msmtprc?

msmtprc is the configuration file for the lightweight SMTP client msmtp. It contains definition blocks that describe how to connect to an SMTP server, which authentication method to use, and what security settings to apply. The syntax is intentionally simple: key/value pairs and account sections that can be referenced by default or by explicit account commands in mail clients such as mutt or mailx.

Why You Need msmtprc

• Centralized configuration: One file controls all outgoing mail for the system or user.
• Lightweight: No full MTA (e.g., Postfix, Sendmail) required, keeping resource usage low.
• Security: Built‑in TLS support and authentication options out of the box.
• Flexibility: Supports multiple accounts, routing rules, and fallback servers.
• Portability: Works on Linux, macOS, BSD, and Windows (via WSL or Cygwin).

Setting Up msmtprc: Step‑by‑Step Playbook

1. Install msmtp

• Debian/Ubuntu: sudo apt-get install msmtp msmtp-mta
• Fedora/CentOS: sudo dnf install msmtp msmtp-mta
• macOS via Homebrew: brew install msmtp

2. Create the Configuration File

• System‑wide: /etc/msmtprc (root only)
• User‑specific: ~/.msmtprc

3. Define Your SMTP Account

account gmail
host smtp.gmail.com
port 587
from you@example.com
auth on
tls on
tls_trust_file /etc/ssl/certs/ca-certificates.crt
user your_gmail_username
passwordeval "pass"

4. Set the Default Account

defaults
auth on
tls on
tls_trust_file /etc/ssl/certs/ca-certificates.crt
account gmail

5. Secure the File

• Permissions: chmod 600 ~/.msmtprc
• Owner: chown $USER:$USER ~/.msmtprc

6. Test the Configuration

• Send a test email: echo "Test body" | msmtp -a gmail recipient@example.com
• Check logs: cat /var/log/syslog | grep msmtp (system‑wide) or msmtp -v for verbose output.

Common Pitfalls & Troubleshooting Checklist

• Incorrect file permissions: Ensure only the owner can read the file.
• Missing TLS CA bundle: Verify tls_trust_file points to a valid CA bundle.
• Wrong authentication type: Use auth on and confirm the SMTP server accepts the method.
• Firewall blocking port 587/465: Open the port or use a VPN.
• Account not set as default: Without defaults or account references, msmtp may fall back to the system MTA.

Advanced Configuration Options

• port: Use 465 for SMTPS or 587 for STARTTLS.
• auth: on or off (disable for servers that allow anonymous relay).
• tls_fingerprint: Pin the server’s TLS fingerprint for extra security.
• tls_cafile / tls_cert: Specify custom CA or client certificates.
• mailhub: Alternative syntax for specifying host:port.
• logfile: Direct msmtp logs to a file for audit and debugging.

Security Best Practices

• Use passwordeval or password with an encrypted password store (e.g., pass, gpg).
• Enable tls on and tls_trust_file by default.
• Prefer OAuth2 tokens for Gmail, Office365, or other providers that support it.
• Restrict outbound traffic to only the necessary SMTP ports.
• Rotate credentials regularly and revoke unused ones.

msmtprc vs. Traditional MTA: Quick Comparison