Email infrastructure · KumoMTA
KumoMTA servers, tuned and operated by people who run mail.
A KumoMTA server is a single-tenant mail host running KumoMTA, the open-source mail transfer agent written in Rust and configured in Lua, released under Apache 2.0 with no per-message fees. VV Internet Hosting provisions it on AMD EPYC bare metal, tunes the policy to your sending profile, and warms your IP pools with you, so the machine sends millions of messages per hour while you keep full control of the configuration.
In short
- Open source, no per-message cost. KumoMTA is Apache-2.0 software; you pay for the server and the operations, not for each message you send.
- Single-tenant by default. Money-sending traffic runs on hardware nobody else touches, so connection concurrency and queue throughput stay yours.
- Policy is real code. Lua controls pool selection, per-destination shaping, DKIM signing, and event hooks — versioned and readable, not hidden behind a console.
- Operated, not just rented. Guided IP warm-up, DMARC alignment, and feedback-loop wiring are part of onboarding.
- Honest fit. If your volume is small or you have no one to run an MTA, we will point you to a managed service or plain Postfix instead.
What is KumoMTA, and why are senders moving to it?
KumoMTA is a mail transfer agent built for organisations that send a lot of email and want to own how it goes out. The core is written in Rust, which gives it the throughput and memory behaviour you want from a queue that never sleeps, and the policy layer is Lua, so the rules that decide how mail is shaped and signed are scripts you can read and version. It is released under the Apache 2.0 license, which is the part that changes the economics: there is no per-message charge and no per-server license to renew.
The reason senders move to it usually comes down to two pressures. The first is cost: platforms that bill per message become painful at volume, and a license tied to throughput grows with the very thing you are trying to scale. The second is control. Large senders, email service providers, and platforms that send on behalf of their own customers want to decide how traffic is split, how aggressively it ramps, and what happens on a bounce — and they want that logic in their own repository rather than in a vendor's dashboard. KumoMTA gives them that, which is why teams leaving PowerMTA or the discontinued Momentum tend to evaluate it first.
What it does not do is earn your reputation for you. A fast MTA gives you the controls to manage authentication, pools, and pacing; the standing with mailbox providers still has to be built over weeks of clean sending. That is the work we do alongside the hosting, and it is the part most sites quietly leave out.
The architecture is worth understanding because it shapes what the host can do. The Rust core handles the queue, the connection pools, and the spool with predictable memory use, so throughput stays flat under load instead of degrading the way garbage-collected MTAs can. Around that core sits the Lua layer, where you write the rules: which pool a message belongs to, how a given destination is paced, how DKIM signing is applied, and what happens when an event fires. Because the policy is ordinary code, you can test it, review it, and roll it back like any other part of your platform.
The ecosystem around it has matured quickly. Recent releases added richer MIME handling and tighter controls for templating and parsing, and the project ships first-class hooks for webhooks, AMQP, and Kafka alongside native Prometheus metrics for Grafana. Large senders such as established ESPs have already migrated production traffic to it, which is the kind of proof that matters more than any benchmark: real volume, sent every day, on hardware the sender controls.
Is KumoMTA the right choice for you?
Sometimes it is, and sometimes it plainly is not. We would rather tell you that now than sell you a server you come to regret, so here is the honest version of the decision.
When KumoMTA earns its place
- You send hundreds of thousands to many millions of messages a month and per-message pricing has started to hurt.
- You send on behalf of your own customers and need pool isolation, your own IPs, and policy you write.
- You have someone — in-house or us — who can operate an MTA and read the dashboards.
- You want delivery, bounce, and feedback events in your own systems over webhooks, Kafka, or AMQP.
When something else is the better call
- Your volume is modest and a managed email service costs less once you count the operational hours.
- You send a small, low-frequency list where a plain Postfix relay is genuinely enough.
- You want a vendor support contract and a phone number more than you want source access — PowerMTA may fit better.
- You have nobody to look at the queue at three in the morning and do not want us to either.
We host and operate both KumoMTA and PowerMTA, and we are comfortable recommending a managed provider we do not sell. The recommendation is meant to fit your situation, not our catalogue.
Compare the full email stack →Getting started
Setting up a KumoMTA server, step by step
Standing up a sending platform should feel like a planned project, with each step owned and dated. Most new senders follow this path with us.
- 01
Sizing call
We start from your daily volume, peak rate, average message size, and the mailbox providers you send to, then size a single-tenant host to it.
- 02
Provision and install
We build the EPYC host, install KumoMTA, lay out RocksDB spools on NVMe, and tune connection and rate limits to your sending profile.
- 03
Authenticate
SPF, DKIM, and DMARC records go in, reverse DNS and TLS are confirmed, and DMARC moves from monitoring to enforcement once reports are clean.
- 04
Warm the IPs
Volume rises on a ramp matched to your numbers while we watch the feedback loops; transactional and marketing pools warm in parallel.
- 05
Hand over the controls
The policy files, the HTTP API, and the Grafana dashboards are yours; we stay on call for tuning.
A production KumoMTA policy, in two files
Configuration lives in Lua, so the rules are explicit. The first block starts a listener locked to your application subnet, lays the spools on fast storage, and opens the event hooks that feed your logging. The second tags each message with a stream, picks the matching egress pool, and shapes how hard the host pushes a given destination. These are the two files we tune with you during onboarding; the values shown are a conservative starting point, not a finished profile.
The shaping rules are where most of the operational care goes. A connection limit that is too high looks aggressive to a mailbox provider and earns throttling; one that is too low leaves throughput on the table. The right numbers depend on the destination and on how warm your IPs are, so we treat them as living settings rather than a one-time decision. The same file is where DKIM signing, TLS policy, and any custom routing live, which keeps the entire egress behaviour of the host in one reviewable place.
-- /opt/kumomta/etc/policy/init.lua — listener, spools, two egress pools
local kumo = require 'kumo'
kumo.on('init', function()
kumo.start_esmtp_listener {
listen = '0.0.0.0:25',
relay_hosts = { '10.0.0.0/24' }, -- your app subnet only
}
kumo.define_spool { name = 'data', path = '/var/spool/kumomta/data', kind = 'RocksDB' }
kumo.define_spool { name = 'meta', path = '/var/spool/kumomta/meta', kind = 'RocksDB' }
-- ship delivery + bounce events to your stack
kumo.configure_log_hook { name = 'webhook' }
kumo.start_http_listener { listen = '127.0.0.1:8000' }
end) -- tag a stream, then shape traffic per destination, per pool
kumo.on('smtp_server_message_received', function(msg)
local pool = msg:get_meta('tenant') == 'mkt'
and 'marketing' or 'transactional'
msg:set_meta('egress_pool', pool)
end)
kumo.on('get_egress_path_config', function(domain, _, _)
return kumo.make_egress_path {
connection_limit = 12,
max_message_rate = '200/s',
max_deliveries_per_connection = 500,
enable_tls = 'Opportunistic',
}
end) Architecture
How KumoMTA fits into your sending stack
Your application hands messages to the host over SMTP or the HTTP API. KumoMTA assigns each one to a pool, signs it, and paces delivery to each mailbox provider, while delivery and bounce events stream back to your own systems for suppression and reporting.
Because the events are structured and pushed in real time, your suppression list, your reputation dashboards, and your retry logic all read from the same source the host does. Prometheus and Grafana plug in the same way, so the numbers a provider uses to judge you are the numbers you watch.
What hardware should a KumoMTA host run on?
The instinct is to chase cores, but a mail host is bound by storage and network long before it is bound by CPU. KumoMTA writes every message to a spool before it is delivered, so the spool has to live on fast NVMe; a slow disk caps your queue throughput no matter how many cores sit idle. We build on single-tenant AMD EPYC Turin or Genoa with DDR5 and NVMe Gen5, and we bias the configuration toward I/O headroom and a clean network with full reverse-DNS control.
Sizing follows your volume rather than a fixed tier. A few hundred thousand messages a day runs comfortably on a modest host; tens of millions a day wants more memory, more spool, and sometimes a second node behind a shared configuration. We would rather start you on one well-tuned machine and add capacity when the numbers ask for it than sell you a cluster you grow into slowly. Running on shared CPU or storage is possible for testing, but serious senders move off it quickly: a noisy neighbour steals exactly the latency that deliverability depends on.
How does KumoMTA compare to PowerMTA and Momentum?
All three move large volumes from a single host, so raw speed rarely decides between them. The difference is the operating model. KumoMTA is open source and scripted in Lua, with no license cost and source you can inspect. PowerMTA is commercial software from Bird, formerly Port25, with the VirtualMTA model many teams already know, a support contract, and a license fee that scales with sending. Momentum, once the high end of this category, is effectively end-of-life, which is why so many migrations are moving away from it now.
If you want a vendor to call and a contract to point at, PowerMTA is a reasonable home and we host it too. If you want to own the configuration, drop the per-message economics, and treat your sending policy as code, KumoMTA is usually the better long-term seat — provided you have the operational capacity to run it, or hand that part to us. For a team leaving Momentum, the practical question is rarely whether to move but which of the two to land on, and that comes back to control versus contract.
The cost comparison is worth doing honestly, because it is rarely as one-sided as either camp claims. KumoMTA removes the license and per-message line entirely, but it adds the cost of operating the host, whether that is your engineers' time or our fee for running it. PowerMTA folds operations into a supported product but charges for the license and scales that charge with your sending. For a high-volume sender with the skills to operate it, KumoMTA almost always wins on total cost over a few years; for a smaller team that values a vendor relationship, the maths can land the other way. We will run those numbers with you on your real volume rather than quote a slogan.
Keeping a KumoMTA host delivering
Hosting the software is the easy half. The half that decides whether your mail reaches the inbox is reputation and authentication, and that is operational work that runs for the life of the server. We set SPF, DKIM, and DMARC with you and sign at the MTA, then move DMARC from monitoring to enforcement once the reports come back clean. We split transactional and marketing streams onto separate pools so a campaign cannot drag down the password-reset mail a customer is waiting on. New IPs warm on a schedule matched to your daily numbers, usually over three to six weeks, and we hold the pace the moment a provider starts to throttle.
Day to day, the feedback loops and bounce processors do the quiet work: complaints and hard bounces are classified, the addresses that hurt your standing are suppressed, and the list you keep sending to stays the list that wants your mail. None of this ships as an upsell. It is part of running a sending host with us, because a KumoMTA server that delivers poorly is not worth hosting and reflects badly on the network it runs from.
It also helps that the host emits the signals you need to act on. Every delivery, deferral, bounce, and complaint becomes a structured event, so you are never guessing at what a provider did with your mail. When a domain starts deferring, you see it in minutes and we adjust the pacing before a slow patch becomes a reputation problem. That tight loop between what the host reports and what we change is most of the difference between a server that merely sends and one that lands.
More on deliverability →Migrating to KumoMTA without downtime
Most senders coming to KumoMTA are already sending somewhere — on PowerMTA, on an aging Momentum install, or on a managed platform they have outgrown — so the migration has to happen with production traffic still flowing. We run the old and new systems in parallel rather than cutting over in one nervous evening. The new host is built, authenticated, and warmed while the existing platform keeps carrying your live volume, which means the new IPs earn their reputation before they take real traffic.
The pieces that travel with you are the ones that protect deliverability: your sending domains, your DKIM keys, and your suppression and bounce history, so you do not re-mail an address you had already learned to leave alone. As the new pools warm, we shift volume across in steps you can watch in the dashboards, holding back the moment a provider signals it wants a slower ramp. Only once the new reputation holds at full volume do we retire the old platform. A migration done this way is uneventful by design, which is exactly what you want from the system that carries your revenue mail. We schedule the cutover around your sending calendar, never in the middle of a major campaign, and keep the old host available to roll back to for a grace period after the switch, so there is always a known-good path behind you.
Questions
KumoMTA, answered plainly
The things senders email us about most.
Is KumoMTA really free to run?
The software is, under the Apache 2.0 license, with no per-message or per-server fee. You pay us for the hardware, the network, and the operations around it, not for the MTA itself. Teams leaving per-message pricing usually look at it first for exactly this reason.
What language is KumoMTA written in, and how is it configured?
The core is written in Rust for throughput and memory safety, and policy is written in Lua. That means traffic shaping, pool selection, signing, and event handling are real code you control, not checkboxes in a console you cannot see into.
How many messages per hour can one KumoMTA host send?
A correctly sized single-tenant host sends millions of messages per hour, but the ceiling in practice is set by the receiving providers and your reputation, not the software. We size the machine so the MTA is never the bottleneck and then shape traffic to what each provider will accept.
Can you migrate me from PowerMTA or Momentum?
Yes, and we run the old and new platforms side by side so nothing stops sending. We carry over your domains, signing keys, and suppression lists, warm the new IPs while the old ones still carry production, and cut over only once the new reputation holds.
Does KumoMTA handle DKIM signing and feedback loops?
Yes. Signing happens at the MTA, and KumoMTA emits structured delivery, bounce, and feedback-loop events over webhooks, AMQP, or Kafka, so your suppression and reputation logic acts on real signals rather than guesses.
Do I need my own engineers to run a KumoMTA server?
You need someone who can read a Lua policy and watch a dashboard, or you let us operate it for you. If you have neither the people nor the volume to justify it, a managed email service is often the better call, and we will say so before you sign anything.
Can KumoMTA run on ARM, in Docker, or on Kubernetes?
Yes. It runs on x86 and ARM, ships container images, and scales horizontally under Kubernetes when you need more than one node. Most senders start on a single tuned host and add nodes only when volume genuinely requires it.
What hardware do you run KumoMTA on?
Single-tenant AMD EPYC Turin or Genoa with DDR5 and NVMe Gen5 for the spool. Cores matter less than fast storage and a clean network with reverse-DNS control, so we bias the build toward I/O and reputation rather than raw core count.
Tell us what you send.
A short call, a sizing, and an honest answer — including when the answer is a managed service instead of a server. No resold licenses.