Knowledge base

PMTA knowledge base›Block <domain>›Directive§ 3.3.10.88

source-ip-max-smtp-out

<domain>

How many simultaneous connections to this recipient domain from one outgoing address

in the configuration this is a linesource-ip-max-smtp-out unlimitedinside the block <domain>

A connection limit not for the queue but for each address in it

The regular max-smtp-out limits the queue as a whole: a queue is a “recipient domain + sending address” pair. If several IPs are brought up inside one sending address, they all share this limit and take from it unevenly — whoever gets there first takes it. This directive sets a ceiling for each address separately.

The mask comes first, not the number. The line looks like source-ip-max-smtp-out CIDR N: the mask says which addresses the rule applies to, the number says how many connections are allowed. The manual phrases the limit as “for a given outgoing address,” that is, each matching address gets the number, rather than it being divided among them. A /24 mask means not 10 connections for the subnet but 10 for each of its addresses.

What counts as a sending address is not decided by this line. enable-source-ip-limits-on-sending-ip chooses between the node’s local address and the one the recipient sees. Without a proxy they coincide; through a proxy the local one is counted by default — one for all — and the “per address” limit stops being a per-address limit.

Do not use the old name. Before this directive appeared, the same thing was called max-smtp-out-per-source-ip; the manual marks it as deprecated and refers here.

The main trap. The directive does not cancel the queue limit but lives beneath it. Both apply, and the lower one triggers: max-smtp-out 20 and source-ip-max-smtp-out 1.2.3.0/24 10 with four addresses in the subnet will give not forty connections but twenty — the queue ceiling will be hit first. Count from the bottom up: how many addresses × how many each, and the queue limit must be no lower than the product.

What the Hub does. It does not write it — because the case the directive was invented for does not arise for it: each sending address gets exactly one smtp-source-host, that is, one IP per queue. The connection ceiling is set right at the address (max-smtp-out in its block), and there is no need to split it by address.

The directive will be needed in someone else’s configuration where several IPs are gathered into one sending address. With the proxy gate it was not needed: each proxy has its own sending address.

Recommended values

Count from the recipient domain, not from the node. The recipient domain sees the sum across all your addresses: five addresses at ten connections each means fifty simultaneous conversations with one mailbox provider, and for most that is a lot. It is sensible to keep the product within the same bounds as the regular queue ceiling.

A mask is a way not to repeat yourself. One line with /24 replaces two hundred fifty-six identical lines, one per address. But remember that each address gets the number: widen the subnet and the sum grows too.

The default is unlimited, which means there is no separate per-address ceiling and only the queue limit applies.

The calculation order is our recommendation. From the manual here come the mask syntax, the unlimited default, the “for a given outgoing address” rule and the reference to the switch.

Example configuration

# one sending address has four IPs brought up
<domain comcast.net>
    max-smtp-out 20
    source-ip-max-smtp-out 1.2.3.0/30 5</domain>

Each of the four addresses in the subnet gets five connections — twenty in total, exactly up to the queue ceiling. With a wider mask, the product would exceed it, and the excess would simply not open.

yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.

▲

Common mistakes and problems

what people get wrong and how it ends3 mistakes▶

Reading the number as a limit for the whole subnet

§ 3.3.10.88

What it costsThe rule applies to each matching address, not to the mask as a whole. 1.2.3.0/24 10 means up to ten connections from each address in the subnet, that is, potentially hundreds, not ten.

How to spot itThe recipient domain responds with “too many connections” even though the configuration has a modest number.

How to do it rightMultiply by the number of addresses actually brought up in this mask and compare the product with the queue ceiling.

Setting a per-address limit while working through a proxy

§ 3.3.10.86

What it costsWith the switch at its default, the node’s local address is counted, and behind a proxy there is one for the whole fleet. The “per address” limit turns into a per-node limit, and the rented addresses share it among themselves.

How to spot itNo matter how many addresses are rented, total connections are capped at the value calculated for one.

How to do it rightEnable enable-source-ip-limits-on-sending-ip and restart the service — a configuration reload is not enough for it.

Forgetting that the queue limit is still there

our experience

What it costsThe directive does not replace max-smtp-out but works beneath it. Carefully laid out per-address limits achieve nothing if the queue ceiling is below their sum: that is what will be hit.

How to spot itTotal connections exactly equal the queue ceiling and do not grow when the per-address limit is increased.

How to do it rightRaise the queue ceiling together with the sum of the per-address limits — or do not set per-address limits at all if there is nothing to split.

Compatibility

PowerMTA 6.0

described in the manual of this version · platform: any

The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.

Reference data

Syntax: source-ip-max-smtp-out CIDR N
Values: a network mask and an integer number of connections — for example 1.2.3.4 10 or 10.0.0.0/24 5
Default: unlimited § 3.3.10.88
Applying: reload, no restart needed
Queue: will not touch what is already queued
Where to write it: <domain>
How many times: once in the block

Everything here comes from the manual, with the section.

Inheritance

The value merges across <domain> blocks from general to specific: the best-matching block wins, not the last one in the file. The line can be repeated with different masks — they split the address space into parts. It is picked up by pmta reload; no restart is needed.

⇄

Related directives

2 relations

Depends on

enable-source-ip-limits-on-sending-ip<domain>The switch that decides which address counts as the outgoing one: the node’s local interface or the one the recipient sees. § 3.3.10.88

Applies to

Four ways to say “slower”The same limiting mechanism, but at the level of an individual sending address. § 3.3.10.88

Referenced from

max-smtp-out<domain>The same ceiling, but broken down by sending address within the queue. § 3.3.10.88 max-smtp-out-per-source-ip<domain>The replacement named by the manual itself: the same meaning, a new name. § 3.3.10.87

How to check on the node

Active connections per address are visible in the monitor; the line itself is checked by reading the configuration together with the included files:

grep -rn source-ip-max-smtp-out /etc/pmta/
pmta show queues --maxitems=20

The sample pmta show settings output in the manual does not contain this line — it was taken from an earlier version. If there are noticeably fewer connections than expected, compare the product “number of addresses × per-address limit” with the queue ceiling: the lower one triggers. The Hub neither writes nor collects this directive.

◇

What else to read

3 articles

◇The sending address — what it is made ofA named set of everything that is a property of the address: which IP the message leaves from, how the node introduces itself, what it signs with and how fast it sends.◇The sender names the stream for each messageThe message carries the name of the stream it should be sent through — the choice is made by the submitting program, not by the node configuration.◇Cloud restrictionsClouds restrict outbound mail on port 25 until you ask them to lift the limit, and mailbox providers treat their address ranges with suspicion.

In the Hub

Cost of a mistake: reversible: harms only while it is set
Scenarios: Address warm-up · Sending through proxies

Neighboring settings of the block <domain>:max-smtp-out max-msg-rate max-connect-rate backoff-max-smtp-out backoff-max-msg-rate All 135 directives of the block →