Demo
Demo

Knowledge base

PMTA knowledge base›Command§ 6.3.35

disable source

critical

Take one address out of service for one queue
How to remove one address without touching the others

Takes the specified sending address out of service for the specified queue. Everything else keeps going as it was: other addresses of the same queue, the same address in other queues, messages already in transit. This is a pinpoint tool — it is used to switch off one bad address for one receiving server, not sending as a whole.

The target is one queue. The domain[/vmta] argument names the receiver and the sending address: yahoo.com/vmta1 is exactly this pair. Without a sending address the engine takes the yahoo.com/{default} queue, and it does not accept a star at all — it replies “Invalid queue name: may not be wildcard.” The address itself must belong to the named sending address, otherwise the reply is “IP address … is not configured for virtual MTA.” Disabling lives in the engine’s memory and survives a configuration reload, but not a service restart.

The same result is produced by a mailbox provider rule. The disable-source-ip action in <smtp-pattern-list> disables an address automatically, by the text of the receiving server’s reply. The command is a manual entry into the same mechanism, and the result of both should be viewed with one command: show disabled sources.

The main trap. Without –reenable-after the address is disabled forever. The default return is set by the reenable-source-ip-after directive, and its default is never. That is, the command without the option means “remove and forget,” and the address will silently sit idle until someone remembers. People remember it when they start investigating why the fleet sends less than it should.
What the Hub does. It calls it — the “Take address out” operation in the “Control” section. The address is picked as an “address · sending domain” pair: the pair also sets the queue’s sending address, while the mailbox provider is named separately. The Hub rejects a star and a target without a sending address itself, before the node: the engine would not accept them anyway. The return deadline is the engine’s –reenable-after, and the input is checked against the pattern ^\d{1,4}[mhd]$; the operation has no deadline of its own, and the engine will bring the address back even if the Hub is unavailable at that moment.

The “IP in a blocklist” policy does not use this command: an address in a blocklist hurts with all receiving servers at once, while disable source takes one queue. So the policy pauses all sending addresses that send from this address. The operation is recorded as reversible: “Return address” takes the address from the operation log.

Recommended values

Always specify –reenable-after. Even when it seems you will bring it back by hand in an hour. An hour turns into a week more often than one would like.

The interval is minutes, hours, days: 30m, 4h, 2d. A sensible order of magnitude for reacting to a receiving server’s block is from an hour to a day: in less than an hour the receiving server usually has no time to “cool down,” and more than a day is already taking the address out of service, which should be done deliberately, not by a timer.

The target is always a pair. yahoo.com/vmta1: without a sending address the command takes the {default} queue, and with a star it does not run. It cannot remove an address for all receiving servers at once — for that, the queues of its sending address are paused.

The interval’s order of magnitude is ours. The refusals for a star and for someone else’s sending address were verified on a node on Sep 15, 2026. From the manual here are the command syntax, the auto-return option and the fact that the default return is set by a directive.
Example configuration
# disable an address for one receiving server for an hour
$ pmta disable source --reenable-after=1h 1.2.3.4 yahoo.com/vmta1
# the command cannot do it for all receiving servers at once — a star gets
# “Invalid queue name: may not be wildcard”; the sending address is paused instead
$ pmta pause queue '*/vmta1'
The first line is the manual’s example. The second is what to do when the address has to be removed for all receiving servers: pause the queues of its sending address. This is what the Hub’s “IP in a blocklist” policy does.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends2 mistakes▶

Calling it without the auto-return option

§ 6.3.35

What it costsThe return is taken from the reenable-source-ip-after directive, and its default is never. The address stays disabled until someone runs the counterpart command by hand.
How to spot itThe fleet sends less than calculated, and the disabled list has addresses from a week ago.
How to do it rightAlways specify –reenable-after. If you really need to remove an address for good, do it deliberately and record it somewhere other than the engine’s memory.

Writing the target with a star or without a sending address

verified on a node

What it costsTo a star the engine replies “Invalid queue name: may not be wildcard,” and without a sending address it takes the {default} queue, which does not have this address. The address is taken out neither there nor there, while tooling that does not read the reply considers the job done.
How to spot itshow disabled sources is empty, and the command’s reply has an error about the queue name or about an address not configured for {default}.
How to do it rightName the queue as a domain/sending-address pair where the address really belongs to this sending address. To remove an address for all receiving servers at once, pause its queues: pause queue */vmta1.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
⇄

Related entries

4 relations

Overrides

reenable-source-ip-after<domain>The command’s –reenable-after option takes precedence over this directive’s value. § 6.3.35

Works together with

Which outgoing addresses are disabledThe only way to see what came out — and along with it everything disabled by mailbox provider rules. § 6.3.37The receiver refused the connectionA persistent refusal of one address by one receiving server is a typical reason to take the address out of service. inference

Can be replaced by

Return an address to serviceThe counterpart command: bring the address back into service by hand without waiting for the timer. § 6.3.36

Referenced from

log-disabled-ips<domain>The event the directive is enabled to record. inferencedisabled-source-ip-notify<domain>One of the two events a message arrives about. § 3.3.10.52backoff-upon-all-sources-disabled<domain>One of the two reasons a queue’s addresses can get disabled. § 3.3.10.55

How to check on the node
The command has one check — see that the list of disabled addresses has changed:
pmta show disabled sources yahoo.com/vmta1
The address should appear in the list right after the call. If it is not there, check that the target is written the same way: disabling is tied to the “receiving server + sending address” pair, and yahoo.com and yahoo.com/vmta1 are different targets.
◇

What else to read

3 articles

◇Backoff mode — the queue's second personalityA queue that a receiver has started refusing switches to a parallel set of limits, retries and routes — ten directives that act only in this mode.◇The sending address — what it is made ofA named set of everything that is a property of the address: which IP the message leaves from, how the node introduces itself, what it signs with and how fast it sends.◇How the node responds to the receiving server's wordsMatches SMTP replies against regular expressions and changes the queue mode on a match — the very trigger that all of the backoff mode machinery waits for.

In the Hub
Cost of a mistake
reversible: harms only while it is set
Scenarios
Troubleshoot deliverability · Sending address rotation · Sending through proxies
Priority
critical