Bichon can receive mail directly over SMTP, so a message is archived at delivery time rather than waiting for the next IMAP poll. The embedded receiver is available in every edition. It is receive-only: Bichon is an archiver, not a mail client, and never sends, forwards, or replies.

The receiver only accepts mail for existing NoSync accounts. It is not a catch-all. To capture an entire tenant's mail flow — including BCC and internal messages — at a single journal address, use SMTP journaling (Pro/Enterprise), which reuses this same listener.

Enabling itCopy Anchor Link

When starttls or tls is selected, both TLS paths are required. none listens in plaintext and should only be used on a trusted network or behind a TLS-terminating gateway.

The listener binds to BICHON_BIND_IP.

Addressing and delivery rulesCopy Anchor Link

• Recipient must exist. RCPT TO is resolved against the account list. An unknown address gets 550 5.1.1 Bichon account not found.
• Only NoSync accounts accept delivery. An IMAP account is synced from its own server, and a View stores nothing; both are refused with 550 5.7.1 … Not a local account that accepts SMTP delivery.
• One recipient per transaction. A second RCPT TO gets 452 4.5.3 Too many recipients, try again in a new transaction. Send one message per transaction.
• 50 MB maximum per message. EHLO advertises SIZE 52428800; larger messages are rejected with 552.
• Deduplication applies. An identical message is archived once and still answered with 250, so the sending server does not retry forever.
• A 250 means recorded, not delivered to a mailbox. Bichon has no mail delivery step.

AuthenticationCopy Anchor Link

EHLO advertises AUTH PLAIN and AUTH LOGIN. The password is a Bichon API token, not the user's WebUI password; the username field is ignored. Create a token under Settings → API Tokens.

The token's owner must hold data:smtp:ingest on the target account (administrators bypass account ACLs). A valid token without that permission gets 554.

With BICHON_SMTP_AUTH_REQUIRED=false, unauthenticated delivery is accepted. There is no source-IP allowlist for ordinary SMTP delivery (journaling has one), so disable authentication only when the listener is reachable exclusively by your trusted gateway or network. Otherwise anyone who can reach the port can inject mail into any NoSync account.

Setting up a mailbox for deliveryCopy Anchor Link

1. Create a NoSync account whose email address is the address your gateway will deliver to.
2. Create an API token for a user with data:smtp:ingest on that account.
3. Configure the sending system or gateway to deliver over SMTP with STARTTLS/TLS and that token as the password.
4. Optionally set an archive filter on the account. Note that a filter silently drops matching messages, so leave it off if the account is meant to capture everything delivered to it.

Session capabilitiesCopy Anchor Link

TroubleshootingCopy Anchor Link

Monitor deliveries with bichon_smtp_messages_total, bichon_smtp_rejections_total, and bichon_smtp_active_connections — see Monitoring & Metrics.