Knowledge base

Taking one address out for one receiver

A targeted withdrawal instead of stopping everything

The task. A receiver rejects or defers messages from one address while accepting the others — and that address must stop being used specifically for it: temporarily, without touching its sending elsewhere and without relying on someone remembering to bring it back.

What it is made of:

  • show domains — confirms the guess by showing the recipient for a single sending address;
  • disable source — withdraws the address for the selected queue, with a –reenable-after deadline;
  • show disabled sources — what is withdrawn now, including by mailbox provider rules;
  • enable source — bring it back before the deadline or if the deadline was forgotten.

The parts have different scopes. Withdrawal applies to an “address and queue” pair, and the radius is set by the queue selector, as with any command. A star turns a pinpoint withdrawal into a withdrawal for all recipients.

How they interact. Proof, action, deadline, reconciliation — these four parts distinguish deliverability management from a pile of forgotten bans. The deadline does the most work: an address withdrawn with a deadline returns by itself, and a wrong diagnosis costs one interval. Reconciliation catches cases where no deadline was set.

The main trap is withdrawing an address without a deadline. Without –reenable-after the address stays withdrawn forever: the cause is long gone, but the sending capacity never came back, and this can be noticed only by reconciliation.
What the Hub does. It applies this — in the “Control” section: the “Take address out” operation runs pmta disable source for an “address and queue” pair, optionally with a –reenable-after deadline after which the engine brings the address back itself; “Return address” lifts the ban earlier and takes the address from the operation log. Before and after the operation the Hub rereads the list of withdrawn addresses and shows the difference — that is the reconciliation from the scheme.

The automatic “IP in a blocklist” policy works differently: an address in a blocklist hurts with all receivers at once, while disable source takes only one queue — to a star the engine replies “Invalid queue name: may not be wildcard.” So the policy pauses all sending addresses that send from this address, for the deadline from the rule (four hours by default), and the Hub lifts the pause.

Recommended values

Four parts:

Part Command What it gives
proof pmta show domains –vmta=vmta1 –errors gmail.com the recipient’s errors for a single sending address
action pmta disable source –reenable-after=4h 198.51.100.25 gmail.com/vmta1 the address is withdrawn only for this queue and will come back by itself
reconciliation pmta show disabled sources gmail.com/vmta1 what is withdrawn now
correction pmta enable source 198.51.100.25 gmail.com/vmta1 return before the deadline
The commands, the return deadline and filtering by sending address come from the manual (§ 6.3.13, § 6.3.35–6.3.37). The scheme itself is our hypothesis.
Example configuration
# withdraw the address only for gmail.com and bring it back in four hours
pmta disable source --reenable-after=4h 198.51.100.25 gmail.com/vmta1pmta show disabled sources gmail.com/vmta1
The address and queue are for illustration. The command does not accept a star: removing an address for all recipients at once is possible only by pausing its sending address.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
How to check on the node
Reconcile the withdrawn addresses with what was actually withdrawn:
pmta show disabled sources
An address that nobody withdrew in the last few hours is a trace of an indefinite withdrawal or a mailbox provider rule; these are exactly the lines reconciliation looks for.