How to Troubleshoot cPanel Email Queue and Delayed Emails

When legitimate business emails sent through a cPanel server take hours to arrive or fail with timeout errors, the cause is usually a clogged Exim mail queue.

On shared and dedicated cPanel servers, an exploited website script or compromised email password can flood the queue with thousands of spam messages. Exim exhausts its worker connections trying to deliver spam, leaving legitimate outgoing emails delayed in the backlog.

---

Quick Answer

Log in to your server as root over SSH and check the current queue count:

exim -bpc

Summarize who is sending and receiving the queued mail:

exim -bp | exiqsumm

If thousands of messages originate from one cPanel user or script directory, locate the script in /var/log/exim_mainlog, remove the spam from the queue using exiqgrep -i -f user@domain.com | xargs exim -Mrm, and flush the legitimate queue with exim -qf.

---

Symptoms

• Outgoing emails sent via webmail or SMTP take 30 minutes to several hours to arrive.
• WHM Mail Queue Manager displays tens of thousands of queued messages.
• Receiving servers (Google Workspace, Microsoft 365, Yahoo) reject connections with rate-limiting codes (421 4.7.0 Try again later).
• Customers submit support tickets reporting that invoices or password reset emails are not reaching clients.
• Server load averages rise due to continuous Exim queue runner processes.

---

Common Causes

1. Compromised web scripts: Vulnerable WordPress plugins or unauthenticated contact form uploaders executing mail() or PHPMailer.
2. Leaked email account credentials: Weak passwords harvested by phishing bots, used to relay hundreds of messages per minute through authenticated SMTP.
3. Frozen bounce messages: Spammers send to non-existent addresses with fake return paths. When receiving servers reject the message, Exim attempts to bounce it to a fake address and freezes the failed notification.
4. Server IP blacklisting: Your server’s public IP address was listed on Spamhaus (ZEN/SBL), Barracuda, or Microsoft SNDS, causing remote mail transfers to stall.
5. Strict remote rate limits: Large providers (like Gmail and Yahoo) throttle incoming connections from your server due to missing or failing SPF, DKIM, or DMARC records.

---

Before You Start

• Never delete the entire /var/spool/exim/input directory directly using rm -rf. Doing so desynchronizes Exim’s spool database and can delete pending legitimate customer correspondence.
• Use Exim’s native queue management commands (exiqgrep, exim -Mrm) to filter and purge messages safely.
• Check whether your server IP is currently listed on public blacklists before adjusting queue timeouts.

---

Step 1 — Check Current Queue Size

Log in to your cPanel server over SSH with root privileges.

Check the total number of emails currently waiting in the spool:

exim -bpc

Interpreting the Result

• 0 to 200 messages: Normal for small to medium hosting servers.
• 200 to 1,000 messages: Elevated. Normal during peak business hours or large newsletter deliveries.
• Over 5,000 messages: Critical queue congestion. Indicates active spamming, remote throttling, or network delivery failure.

---

Step 2 — Summarize the Queue by Sender and Domain

To identify whether one user or external domain is responsible for the backlog, run exiqsumm:

exim -bp | exiqsumm

Sample Output

Count  Volume  Oldest  Newest  Domain
-----  ------  ------  ------  ------
 4200   18MB    4d      2m     yahoo.com
 3850   15MB    4d      1m     hotmail.com
  120  480KB    2h      5m     gmail.com
    4   12KB   10m      1m     examplecorp.com
---------------------------------------------
 8174   33MB    4d      1m     TOTAL

What This Tells You

• If thousands of messages are piled up waiting for yahoo.com or hotmail.com, your server is either blacklisted by those providers or a local account is blasting spam toward their servers.
• If a single domain has thousands of queued messages that are days old, those messages are prime candidates for investigation.

---

Step 3 — Inspect Queued Messages

Find individual message IDs and read their routing headers.

List the 10 oldest messages in the queue:

exiqgrep -o 86400

• -o 86400 filters for messages older than 86,400 seconds (24 hours).

Pick a specific message ID from the left column (for example, 1sqA3b-0004Z2-9K) and inspect its delivery headers:

exim -Mvh 1sqA3b-0004Z2-9K

What to Look For in Headers

1sqA3b-0004Z2-9K-H
mailnull 47 12
<>
1718012345 0
-ident mailnull
-received_protocol local
-body_linecount 45
-auth_id customer_sales@example.com

• -auth_id: If present, this tells you the authenticated email account used to submit the message via SMTP. If it shows an authentic customer mailbox, that email account’s password was compromised.
• <> (Empty sender): Indicates a bounce notification.
• If -received_protocol is local and user is nobody, a web script on the server generated the email.

To inspect the message body text without releasing the message:

exim -Mvb 1sqA3b-0004Z2-9K | head -n 30

---

Step 4 — Locate the Script Responsible for Spam

If the emails were generated locally via PHP scripts, examine the Exim log to find the exact working directory (cwd) of the script:

grep "cwd=" /var/log/exim_mainlog | grep -v "/var/spool/exim" | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n

Sample Output

     12 /home/clientone/public_html
     34 /home/clienttwo/public_html/contact
  14890 /home/vulnerableuser/public_html/wp-content/uploads/temp

In this output, a PHP backdoor running from /home/vulnerableuser/public_html/wp-content/uploads/temp generated nearly 15,000 spam emails.

Immediate Containment Action

1. Disable the compromised script or suspend the cPanel account immediately via WHM or command line:

   /scripts/suspendacct vulnerableuser "Spam outbreak detected"

2. If authenticated SMTP abuse was identified, reset the mailbox password through cPanel or WHM API.

---

Step 5 — Safely Clean the Mail Queue

Now that the source of the spam has been closed, purge the unwanted messages to allow legitimate mail to flow.

1. Delete All Frozen Messages

Frozen messages are failed deliveries or undeliverable bounces consuming memory and disk:

exiqgrep -z -i | xargs exim -Mrm

• -z: Filters for frozen messages.
• -i: Outputs message IDs only.
• exim -Mrm: Removes the messages from the spool.

2. Delete Queued Messages from a Specific Sender or Domain

Remove all queued spam sent by the compromised address:

exiqgrep -i -f "spammer@compromised-domain.com" | xargs exim -Mrm

3. Force Exim to Deliver Legitimate Backlog

Once spam is cleared, trigger a queue runner to attempt delivery of remaining valid messages:

exim -qf -v

• -qf: Forces a queue run for all non-frozen messages, ignoring retry delays.
• -v: Verbose output to watch delivery handshakes with destination servers.

---

Step 6 — Verify Real-Time Delivery

Monitor /var/log/exim_mainlog in real time to verify that outgoing emails are completing successfully:

tail -f /var/log/exim_mainlog | grep -E "Completed|rejected|defer"

Look for lines containing:

• => recipient@domain.com R=lookuphost T=remote_smtp H=... [Completed]
• A high volume of Completed entries indicates the queue is clearing successfully.

---

Common Mistakes

1. Forgetting to stop the sender before clearing the queue: Running exim -Mrm while a malicious PHP script is still generating 100 emails a second will achieve nothing. Always suspend the account or isolate the script first.
2. Deleting /var/spool/exim files directly: Deleting spool files with rm corrupts Exim’s internal hints database (/var/spool/exim/db/), requiring a complete spool rebuild.
3. Ignoring DNS reverse PTR records: Remote mail servers reject or defer emails if your server’s sending IP does not have a matching forward-confirmed reverse DNS (FCrDNS) record.

---

Prevention Checklist

• Set Max hourly emails per domain in WHM (Tweak Settings -> Mail) to 100–200 to cap accidental or malicious blasts.
• Enable Prevent “nobody” from sending mail in WHM to force scripts to send through authenticated channels.
• Enforce strong password requirements for all cPanel email accounts.
• Verify SPF, DKIM, and DMARC records for all hosted client domains.
• Set up proactive 24/7 monitoring through our cPanel server support team to catch queue spikes before your server IP gets blacklisted.

---

Quick Reference Commands

Purpose	Command
Check total queue count	exim -bpc
View queue summary by domain	exim -bp | exiqsumm
View 20 oldest messages	exiqgrep -o 86400
View message headers	exim -Mvh <MSG-ID>
View message body	exim -Mvb <MSG-ID>
Delete all frozen messages	exiqgrep -z -i | xargs exim -Mrm
Delete mail from specific sender	exiqgrep -i -f user@domain.com | xargs exim -Mrm
Force deliver pending queue	exim -qf
Monitor active mail log	tail -f /var/log/exim_mainlog

---

Frequently Asked Questions

What does “Frozen” mean in the Exim mail queue?

A frozen message is an email that Exim cannot deliver and cannot return to the sender (often because the sender address was spoofed or invalid). Exim pauses the message to avoid wasting resources on repeated delivery attempts. You can safely purge frozen messages.

How do I know if my server IP is blacklisted?

Check your server’s public IP on multi-RBL checkers like MXToolbox or Spamhaus. In Exim logs, blacklisting appears as 550 Service unavailable; Client host [x.x.x.x] blocked using Spamhaus or 554 Denied by policy.

Can I delete messages older than 2 days in one command?

Yes. Use exiqgrep -o 172800 -i | xargs exim -Mrm. The number 172800 represents 48 hours in seconds.

Why does Gmail defer emails with a 421 error?

Google applies progressive rate limits when a new or low-reputation IP sends unexpected mail volumes, or when incoming messages fail DMARC/SPF authentication. Once your queue clears and spam stops, Gmail typically lifts the rate limit within 24 to 48 hours.

How does ServerCare360 assist web hosts with cPanel mail deliverability?

Our cPanel support and outsourced technical support engineers monitor mail queues round-the-clock, configure automated outbound rate limiters, isolate malware scripts, handle RBL blacklist delistings, and maintain high IP sender reputations for hosting providers.