diff --git a/lib/ddns/index.js b/lib/ddns/index.js
index f7cabe6..6d75878 100644
--- a/lib/ddns/index.js
+++ b/lib/ddns/index.js
@@ -32,7 +32,9 @@ module.exports.create = function (deps, conf) {
         throw new Error('failed to lookup IP for tunnel domain "' + tunnelDomain + '"');
       }
 
-      await dnsCtrl.setDeviceAddress(dnsSession, addrList[0], domainList);
+      if (!mod.disabled) {
+        await dnsCtrl.setDeviceAddress(dnsSession, addrList[0], domainList);
+      }
     } catch (err) {
       console.log('error starting tunnel for', domainList.join(', '));
       console.log(err);
@@ -207,8 +209,11 @@ module.exports.create = function (deps, conf) {
 
     // Then remove DNS records for the domains that we are no longer responsible for.
     await Promise.all(Object.values(prevMods).map(function ({mod, domainList}) {
+      // If the module was disabled before there should be any records that we need to clean up
+      if (mod.disabled) { return; }
+
       var oldDomains;
-      if (!curMods[mod.id] || mod.tokenId !== curMods[mod.id].mod.tokenId) {
+      if (!curMods[mod.id] || curMods[mod.id].disabled || mod.tokenId !== curMods[mod.id].mod.tokenId) {
         oldDomains = domainList.slice();
       } else {
         oldDomains = domainList.filter(function (domain) {
@@ -232,6 +237,9 @@ module.exports.create = function (deps, conf) {
 
     // And add DNS records for any newly added domains.
     await Promise.all(Object.values(curMods).map(function ({mod, domainList}) {
+      // Don't set any new records if the module has been disabled.
+      if (mod.disabled) { return; }
+
       var newDomains;
       if (!prevMods[mod.id] || mod.tokenId !== prevMods[mod.id].mod.tokenId) {
         newDomains = domainList.slice();