Manage the Exim mail queue in WHM (Mail Queue Manager, root)

On a cPanel & WHM server, outgoing and incoming mail waits in the Exim queue when it cannot be delivered right away. A few hundred deferred messages are normal; thousands usually mean a spam outbreak or a remote server rejecting your mail. WHM's Mail Queue Manager and a few Exim commands let you see what is there and clean it up.

Before you start

• Root access to WHM (https://server-hostname:2087) and SSH.
• On MdmHost shared and reseller hosting our team manages the queue; this guide is for your own server or VPS.

Check the queue size

exim -bpc

shows the number of messages. For a summary by domain:

exim -bp | exiqsumm | sort -n -k1 | tail -20

Use Mail Queue Manager in WHM

1. Open WHM → Email → Mail Queue Manager.
2. Filter by Sender, Recipient, Message ID or Subject, and by date.
3. Click a message to see its headers, body and delivery log.
4. Select messages and choose Deliver (try again now) or Delete. Deliver All and Delete All act on the whole filtered result.

Find the source of spam

1. Open a few queued messages and read the headers. Look for:
   • X-Authenticated-Sender: a mailbox password was stolen.
   • X-PHP-Script or X-PHP-Originating-Script: a script on a website sends the mail; the header shows the account and file.
   • X-Get-Message-Sender-Via ... authenticated_id: the cPanel user responsible.
2. Count senders in the queue:
   Copy

   exim -bp | awk '/^ *[0-9]+[mhd]/{print $4}' | sort | uniq -c | sort -n | tail

3. Stop the source: change the mailbox password, suspend outgoing mail for the account (WHM → Account Functions → Manage Account Suspension or the account's email settings), or disable the abused script.

Clean up from the command line

After a spam incident

• Check whether the server IP is blocklisted and request delisting once the source is fixed.
• Limit hourly sending per domain in WHM → Server Configuration → Tweak Settings → Mail (Max hourly emails per domain) and per package.
• Review SPF, DKIM and DMARC for affected domains.

Next steps

• Exim Configuration Manager basics
• Limit outgoing email per account
• How hourly limits affect users