A server’s mail transfer agent (MTA) is responsible for routing system notifications, contact form messages, and user correspondence. In cPanel/WHM environments, Exim serves as the default MTA. Over time, outbound mail queues can grow due to delivery failures, DNS resolution errors, or spamming scripts that exploit insecure contact forms. When the Exim mail queue builds up, system resources are consumed, disk space is filled, and legitimate email deliveries are delayed.
For systems administrators, managing the Exim mail queue is essential for keeping mail services responsive. Leaving thousands of unsent messages in the queue can lead to your server IP being blacklisted by mail providers like Google, Yahoo, and Microsoft. In this guide, we will explore how Exim processes mail, diagnose queue backlogs, and walk through the SSH commands needed to inspect, flush, and manage the Exim mail queue.
1. Understanding the Exim Mail Queue
When a cPanel user sends an email, the message is passed to Exim. Exim attempts to deliver the message immediately by querying the recipient domain's MX records and establishing a SMTP connection. If the recipient server rejects the connection (e.g., due to rate limits or graylisting), or if the destination server is offline, Exim moves the email to the mail queue.
The queue consists of two files per email, stored in /var/spool/exim/input/: the data file containing the email body, and the header file containing routing information, headers, and log records. Exim periodically retries delivery for queued messages based on its retry configuration (typically every 30 minutes). If a message cannot be delivered after a set period (usually 5 days), it is marked as "frozen" and eventually bounced or discarded.
2. Step-by-Step Diagnostic Commands via SSH
To troubleshoot Exim mail queue issues, log into your server via SSH as the root user. Use these commands to inspect, manage, and flush the queue.
Step 2.1: Check Exim Queue Size and Volume
To check the number of messages currently waiting in the Exim mail queue, run:
exim -bpcA normal queue size for small to medium servers is under 100 messages. If the output shows thousands of messages, the queue is backed up, indicating potential spam activity or network delivery issues.
Step 2.2: List Queued Messages
To view a list of all messages in the queue, including their message ID, age, size, sender, and recipient addresses, run:
exim -bpTo view the queue sorted by volume or sender domains, use the cPanel script utility:
/usr/sbin/exiqsummarcThis summary lists the volume of emails per sender and domain, helping you identify if a specific account is sending high volumes of spam.
Step 2.3: Inspect Message Content
If you find a suspicious message ID in the queue (e.g., 1a2b3c-4d5e6f-7g), inspect its contents to determine if it is spam or legitimate. Run these commands to check the message details:
exim -Mvh 1a2b3c-4d5e6f-7g # View email headers
exim -Mvb 1a2b3c-4d5e6f-7g # View email body (raw content)
exim -Mvl 1a2b3c-4d5e6f-7g # View Exim delivery logs for this messageChecking the headers allows you to locate the X-PHP-Script or cwd path, which shows the directory of the PHP script sending the emails. This is useful for finding compromised scripts or vulnerable forms.
Step 2.4: Force Queue Flush
Once you resolve network connectivity issues or clean up spamming scripts, instruct Exim to attempt delivery for all queued messages immediately:
exim -qf # Force delivery attempt for all messages
exim -qf -v # Force delivery attempt with verbose console outputTo flush only messages sent to a specific domain (e.g., gmail.com), run:
exim -qR gmail.comStep 2.5: Remove Frozen and Spam Emails
If the queue is filled with frozen bounce notifications or spam, you can delete them to free up server resources. Run these commands to clean up the queue:
# List and delete all frozen emails
exiqgrep -z -i | xargs exim -Mrm
# Delete messages from a specific sender address
exiqgrep -f '[email protected]' -i | xargs exim -Mrm
# Delete messages older than 24 hours (86400 seconds)
exiqgrep -o 86400 -i | xargs exim -MrmThe exim -Mrm command removes the header and data spool files for the specified message IDs, deleting them from the queue.
3. Common Exim Mail Queue Issues and Resolutions
| Problem / Symptom | Common Root Cause | Resolution Action |
|---|---|---|
| Queue filled with "frozen" messages | Delivery failures or bounce notifications to invalid addresses | Delete frozen messages using exiqgrep -z -i | xargs exim -Mrm |
High volume of mail from nobody or cpanel_user |
Compromised contact form or PHP script sending spam | Inspect email headers with exim -Mvh, find script path, and secure it |
| All outbound mail fails with timeout | ISP or host blocking port 25; broken local DNS setup | Verify outbound port 25 access; check DNS resolvers in /etc/resolv.conf |
| Exim fails to start / locked spool | Corrupt queue databases or disk space full | Free up disk space; clean up lock files in /var/spool/exim/db/ |
Frequently Asked Questions (FAQ)
What does it mean when an email is "frozen" in the Exim queue?
An email is marked as "frozen" when Exim fails to deliver it after multiple attempts and the bounce notification itself cannot be delivered to the sender's address. Frozen messages remain in the queue until they are manually removed or reach the Exim timeout limit.
How do I find the PHP script that is sending spam emails?
Inspect the headers of a queued message using exim -Mvh [MessageID]. Look for the X-PHP-Script or cwd headers, which list the script name and directory from which the mail process was initiated.
Can I configure Exim to limit outbound emails per hour?
Yes. In WHM, navigate to **Tweak Settings** and search for "Max hourly emails per domain". Setting a limit (e.g., 200 emails per hour) helps prevent compromised accounts from sending large volumes of spam and protects your server IP reputation.