Knowledge base

PMTA knowledge base›Block <domain>›Directive§ 3.3.10.91

source-ip-max-connect-rate

<domain>

How fast to open connections from one outgoing address

in the configuration this is a linesource-ip-max-connect-rate unlimitedinside the block <domain>

The rate of new connections, counted per address

It limits not the number of simultaneous conversations but the rate at which they are opened: how many new connections to this recipient domain may be started per interval from a given sending address. The neighboring source-ip-max-smtp-out handles the former, this one the latter, and they should not be confused: ten persistent connections and ten new ones every minute look completely different to a receiver.

Frequent reconnects irritate receivers more than volume. Large mailbox providers count connection attempts specifically, and a burst of connections from one address is a typical reason to respond with 421 and hold the sender back. A steady rate with long-lived connections looks much healthier than a ragged one.

The mask comes first, and each address gets the number. source-ip-max-connect-rate 1.2.3.0/24 60/m means sixty connections per minute from each address in the subnet, not sixty for the whole subnet. What exactly counts as a sending address is decided by enable-source-ip-limits-on-sending-ip.

The main trap. The limit is easy to “satisfy” in a way other than intended. If the engine closes connections quickly, it will hit the connection rate with a quite small message flow — and sending will stretch out even though the message limit is far from used up. The cure is not raising this number but making connections live longer: that is exactly what smtp-out-rampup-interval and connection-idle-timeout exist for.

What the Hub does. It does not write it. In the Hub’s fleet the connection rate is set at queue level — max-connect-rate in the mailbox provider rule — and each queue has one sending address, so there is nothing to split by address.

The directive will be needed where several IPs are gathered into one sending address. With the proxy gate it was not needed: each proxy has its own sending address, and the queue’s connection rate already belongs to one rented address.

Recommended values

Start from the number of simultaneous connections, not from volume. If a receiver is allowed ten connections and each lives a minute, a connection rate above ten per minute means connections are being closed too early. Start with a value of the same order as the connection ceiling.

The denominator accepts a multiplier. 100/15m means a hundred connections in fifteen minutes; convenient when the natural window does not fit a minute or an hour. The multiplier appeared in PowerMTA 5.

The default is unlimited — the connection rate from an individual address is not limited, and only the queue limit applies.

The calculation order and the advice about connection length are ours. From the manual here come the mask syntax, the rate grammar, the unlimited default and the reference to the switch.

Example configuration

# a steady connection rate: as many as the connections we hold
<domain hotmail.com>
    max-smtp-out 10
    source-ip-max-connect-rate 1.2.3.4 10/m    connection-idle-timeout 1m
</domain>

Ten connections, ten new connections a minute and a minute of waiting before closing — this way connections are reused rather than opened anew for every message.

yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.

▲

Common mistakes and problems

what people get wrong and how it ends3 mistakes▶

Confusing the connection rate with the number of connections

our experience

What it costs10/m here means ten new connections per minute, not ten simultaneous ones. The receiver may see either one persistent connection or ten short ones — very different behavior, while the line looks similar to source-ip-max-smtp-out.

How to spot itThere are few simultaneous connections and many messages in the queue, and sending goes in jerks.

How to do it rightKeep the two settings apart by meaning: how many conversations to hold at once and how often to start new ones. Usually both are needed.

Reading the number as a limit for the whole subnet

§ 3.3.10.91

What it costsThe rate applies to each matching address. 1.2.3.0/24 60/m means up to sixty connections per minute from each address in the subnet, and the receiver will see the sum across all of them.

How to spot itThe receiver responds with 421 even though the configuration has a small number.

How to do it rightMultiply by the number of addresses in the mask and compare the sum with what the receiver is willing to accept.

Raising the rate instead of lengthening connections

our experience

What it costsIf connections close right after a message, any number here will have to be raised endlessly, and the receiver will see a stream of short connections — the thing it complains about most often.

How to spot itThe number of connections is comparable to the number of messages.

How to do it rightSet connection-idle-timeout and smtp-out-rampup-interval so that connections are reused, and only then look at the connection rate.

Compatibility

PowerMTA 6.0

described in the manual of this version · platform: any

The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.

Reference data

Syntax: source-ip-max-connect-rate CIDR { unlimited | 0 | N/[M]{d|day|h|hr|m|min|s|sec} }
Values: a network mask and a rate — for example 1.2.3.4 60/m; unlimited, 0 and a multiplier in the denominator (100/15m) are allowed
Default: unlimited § 3.3.10.91
Applying: reload, no restart needed
Queue: will not touch what is already queued
Where to write it: <domain>
How many times: once in the block

Everything here comes from the manual, with the section.

Inheritance

The value merges across <domain> blocks from general to specific: the best-matching block wins, not the last one in the file. The line can be repeated with different masks. It is picked up by pmta reload; no restart is needed.

⇄

Related directives

2 relations

Depends on

enable-source-ip-limits-on-sending-ip<domain>The switch that decides which address counts as the outgoing one. § 3.3.10.91

Applies to

Four ways to say “slower”The same limiting mechanism, but at the level of an individual sending address. § 3.3.10.91

How to check on the node

There is no separate per-address connection counter; the line is checked by reading the configuration, and its effect by the number of connections in queues:

grep -rn source-ip-max-connect-rate /etc/pmta/
pmta show queues --maxitems=20

A sign that this is exactly what was hit: queues consistently have fewer connections than the allowed ceiling, while there are many messages in the queue. That means new connections are not being opened fast enough. The Hub does not collect this rate.

◇

What else to read

3 articles

◇The sending address — what it is made ofA named set of everything that is a property of the address: which IP the message leaves from, how the node introduces itself, what it signs with and how fast it sends.◇The sender names the stream for each messageThe message carries the name of the stream it should be sent through — the choice is made by the submitting program, not by the node configuration.◇Cloud restrictionsClouds restrict outbound mail on port 25 until you ask them to lift the limit, and mailbox providers treat their address ranges with suspicion.

In the Hub

Cost of a mistake: reversible: harms only while it is set
Scenarios: Address warm-up · Sending through proxies

Neighboring settings of the block <domain>:max-smtp-out max-msg-rate max-connect-rate backoff-max-smtp-out backoff-max-msg-rate All 135 directives of the block →