cPanel Exim Mail Queue Congestion: Diagnosis and Remediation Guide

A bloated Exim mail queue on a cPanel/WHM server indicates legitimate outbound volume congestion, remote destination throttling (such as Gmail, Yahoo, or Microsoft rate limits), or a compromised cPanel account transmitting unauthorized bulk spam.

Production Warning: Do not delete the entire Exim mail queue with blind rm commands in /var/spool/exim/input/. This destroys valid customer emails and corrupts the internal Exim spool index database.

At a Glance

Count and summarize messages in the Exim queue using exim -bpc and exiqsumm.
Inspect headers of stuck messages using exim -Mvh to identify sending scripts.
Parse /var/log/exim_mainlog to locate high-volume senders.
Purge frozen or spam messages using exiqgrep.
Enforce hourly domain sending limits in WHM Tweak Settings.

Prerequisites

Before managing the mail queue:

Root SSH access to the cPanel/WHM server.
Exim mail transfer agent installed and running.
Familiarity with /var/log/exim_mainlog.

Step 1: Check Queue Size and Summarize Mail Volume

# Count total messages in queue
exim -bpc

# Generate a queue summary by domain and count
exim -bp | exiqsumm

Step 2: Identify Compromised Accounts and PHP Scripts

Inspect specific message headers to identify how the emails were generated:

# View message headers for a specific message ID
exim -Mvh 1sABCd-000123-EF

Key Headers to Inspect:

X-PHP-Originating-Script: Reveals the exact PHP script path (e.g. /home/user/public_html/cache.php).
X-PHP-Script: Displays the HTTP URI that triggered the mail() function.
Received: from ... [192.0.2.1] (auth=user@domain.com): Identifies compromised SMTP credentials.

Search the Exim main log to count senders today:

# Top authenticated SMTP logins today
grep "A=dovecot_login:" /var/log/exim_mainlog | awk '{print $NF}' | sort | uniq -c | sort -nr | head -n 10

# Top PHP script directories sending mail
grep "cwd=/home" /var/log/exim_mainlog | awk '{print $3}' | sort | uniq -c | sort -nr | head -n 10

Step 3: Remove Spam and Frozen Messages Safely

Use exiqgrep to filter and delete messages without damaging legitimate email queues:

Delete Frozen Messages Only:

# Purge all frozen messages from spool
exiqgrep -z -i | xargs -r exim -Mrm

Delete Messages from a Specific Sender Address:

# Purge messages originating from a compromised email
exiqgrep -f "spammer@compromised-domain.com" -i | xargs -r exim -Mrm

Force Legitimate Queue Delivery:

# Force delivery attempt for remaining legitimate queue
exim -qf -v

Step 4: Enforce Preventive Limits in WHM

To prevent future mail queue congestion:

In WHM, navigate to Server Configuration >> Tweak Settings >> Mail.
Set Max hourly emails per domain to a safe threshold (e.g., 100 or 250).
Enable Prevent “nobody” from sending mail to require SMTP authentication.
Enable Track email origins via X-PHP-Script header.

Troubleshooting

Problem: “Exim queue size continues growing rapidly even after deleting messages”

Possible cause: A rogue cron job or active PHP backdoor is continuously executing and queuing new messages.

Check:

ps aux | grep -E 'php|cron'

Solution: Suspend the compromised cPanel account or disable PHP execution in the user’s public_html until malware is cleaned.

Verify the Configuration

Verify that the queue count has normalized and legitimate emails are dispatching:

# Verify queue count is under normal threshold
exim -bpc

Production Checklist

Inspected stuck message headers with exim -Mvh.
Isolated sending script or compromised email account.
Deleted spam messages cleanly with exiqgrep.
Suspended compromised accounts or updated passwords.
Configured hourly email sending limits in WHM.
Verified normalized queue count (exim -bpc).

Frequently Asked Questions

Will deleting messages with `exim -Mrm` notify the recipient?

No. exim -Mrm deletes the message directly from the spool without generating non-delivery bounce reports.

How do I check if my server IP is blacklisted?

Run a check using tools like MXToolbox or query major RBLs (Zen Spamhaus, Barracuda, SpamCop) against your server’s primary outbound IP address.

Need Help Managing cPanel Mail Reputation?

If you manage hosting servers and need help resolving Exim queue congestions, preventing blacklisting, or configuring DKIM/DMARC policies, contact our hosting engineering team.