# Configuration {#configuration}


`nitromta setup` writes the configuration, with every setting it leaves at
its default commented out and each explained beside it. For the host name
and return path domain the [installation guide](https://nitromta.com/docs/install/index.md) uses:

```sh
sudo -u nitromta nitromta setup --config /etc/nitromta/config.toml \
  --hostname mta.example.com --return-path-domain bounces.example.com
```

it writes:

```toml
# NitroMTA's configuration, as `nitromta setup` wrote it. Each commented
# setting is at its default.

[store]
# The SQLite database; its directory holds its write-ahead log too.
path = "/var/lib/nitromta/store.db"
# The installation's keys, which seal the secrets in policy: a file of its
# own, apart from the store and its backups, which only its owner may read.
keys = "/etc/nitromta/keys"
# Free space kept on the store's disk; new mail is refused below it.
# reserve_mib = 1024
# Bytes of mail waiting for their commit before new mail is refused.
# pending_mib = 512
# How long finished mail is kept, for bounces and complaints that come
# after it.
# feedback_window_seconds = 604800

[submission]
# SMTP submission, for applications, with STARTTLS and a login.
listen = "0.0.0.0:587"
hostname = "mta.example.com"
certificate = "/etc/nitromta/tls.crt"
key = "/etc/nitromta/tls.key"
# max_message_bytes = 40000000
# max_recipients = 50
# How long mail is tried before it expires.
# lifetime_seconds = 259200

# The SES v2 API, for applications that call it, on its own certificate.
# [ses]
# listen = "0.0.0.0:443"
# certificate = "/etc/nitromta/tls.crt"
# key = "/etc/nitromta/tls.key"
# region = "us-east-1"

[admin]
# The native API, for the CLI: the engine's own user, or root, alone.
socket = "/run/nitromta/admin.sock"

# Bounces and complaints, at the return path's domain's MX.
[feedback]
listen = "0.0.0.0:25"
hostname = "mta.example.com"
certificate = "/etc/nitromta/tls.crt"
key = "/etc/nitromta/tls.key"

[delivery]
# The name an egress greets with when it names none.
helo = "mta.example.com"
# Return paths are made under this domain, which bounces go to.
return_path_domain = "bounces.example.com"
# The key return paths are made with: this installation's own.
return_path_key = "<64 hex digits, generated by setup>"
# Keys from before a rotation: bounces to return paths made with them are
# still taken, for as long as their mail may still bounce.
# previous_return_path_keys = []
# Mail goes only over TLS: a receiver that does not offer STARTTLS is
# tried again until the mail expires. False lets it go in the clear to
# such a receiver.
# require_tls = true
# The resolver lookups go through, as an address and port; the system's
# when absent. DANE needs one that validates DNSSEC, such as a local
# unbound.
# resolver = "127.0.0.1:53"
# mta_sts = true
# dane = true

# [operator]
# Health and metrics, in Prometheus's text format.
# listen = "127.0.0.1:9090"

# [log]
# level = "info"
# format = "json"

# [scheduler]
# How long a stop waits for attempts under way.
# drain_seconds = 20
# retry_first_seconds = 60
# retry_max_seconds = 3600
```

The engine reads the configuration as it starts, and `nitromta doctor`
checks it. Policy, the accounts, identities and egresses mail is sent
with, is not configuration: it is given through the admin socket and kept
in the store, as [installation](https://nitromta.com/docs/install/index.md#5-give-it-its-policy) shows.