When a compromised mailbox or a hacked script floods a server with spam, the Exim mail queue can grow to tens of thousands of messages, slowing all mail and getting the server's IP address blocklisted. This guide shows how to measure the queue, stop the source, remove the junk (selectively or all at once) and keep it from coming back. It is for administrators of their own server running Exim, such as a cPanel/WHM or DirectAdmin server, and needs root access.
First find and stop the sender, or the queue refills as fast as you empty it. Then remove messages selectively with exiqgrep -i -f sender | xargs -r exim -Mrm, or clear everything with exiqgrep -i | xargs -r exim -Mrm. For a queue too large for that, stop Exim, move the input and msglog spool folders aside, recreate them with the same owner and permissions, and start Exim again. Clearing the queue deletes genuine mail too, so be selective when you can.
Every command here needs root on the mail server. On Domain India shared hosting (cPanel, DirectAdmin, Webuzo), the mail queue belongs to the whole server and is managed by us. If your mail is stuck or your account is sending spam, open a support ticket instead.
1. Measure the queue
exim -bpc # number of messages in the queue
exim -bp | exiqsumm | sort -rn | head -20 # messages per destination domainFind the top senders. In exim -bp output, each message starts with a line showing its age, size, ID and sender:
exim -bp | awk '/^ *[0-9]+[smhd] /{print $4}' | sort | uniq -c | sort -rn | head -10A single address or domain with thousands of messages is almost always your source. <> as the sender means bounces, which usually follow the spam.
2. Stop the source before you clear anything
If the sender is still active, the queue refills within minutes. Work out whether the spam comes from a mailbox login or from a script.
Mailbox logins (a stolen email password). On cPanel the main log is /var/log/exim_mainlog; on DirectAdmin it is /var/log/exim/mainlog:
grep -o 'A=dovecot_[a-z]*:[^ ]*' /var/log/exim_mainlog | sort | uniq -c | sort -rn | headScripts (a hacked website sending through PHP). The cwd= field shows the folder the sending script ran from:
grep -o 'cwd=/home[^ ]*' /var/log/exim_mainlog | sort | uniq -c | sort -rn | headThen act on what you found:
whmapi1 suspend_outgoing_email user=USERNAME until it is clean.systemctl stop exim while you investigate, so nothing more leaves the server.3. Remove messages selectively
exiqgrep selects messages; -i prints only their IDs, which exim -Mrm removes. The -r on xargs stops it running when nothing matches.
# everything from one sender (address or part of it)
exiqgrep -i -f '[email protected]' | xargs -r exim -Mrm
# everything to one recipient domain
exiqgrep -i -r '@victim-domain.example' | xargs -r exim -Mrm
# frozen messages (mostly undeliverable bounces)
exiqgrep -z -i | xargs -r exim -Mrm
# anything older than one day (86,400 seconds)
exiqgrep -o 86400 -i | xargs -r exim -MrmCheck a sample before deleting in bulk: exim -Mvh MESSAGE_ID shows a message's headers and exim -Mvb MESSAGE_ID its body.
4. Clear the whole queue
When the queue is almost entirely spam, remove everything:
exiqgrep -i | xargs -r -n 1000 exim -Mrm-n 1000 passes the IDs in batches, which avoids "argument list too long" on very large queues. For a few thousand messages this is fast enough.
Clearing the queue removes every waiting message, including real customer mail that was only delayed. Senders are not told. Prefer the selective commands in section 3, and clear everything only when you are sure the queue is junk.
5. The fastest way for a huge queue
With hundreds of thousands of messages, exim -Mrm can take hours. It is quicker to swap the spool folders. Exim must be stopped first, and the new folders must keep the old owner and permissions, which differ between cPanel and DirectAdmin; --reference copies them exactly:
systemctl stop exim
cd /var/spool/exim
mv input input.old && mv msglog msglog.old
mkdir input msglog
chown --reference=input.old input && chmod --reference=input.old input
chown --reference=msglog.old msglog && chmod --reference=msglog.old msglog
systemctl start exim
exim -bpcWhen exim -bpc shows 0 (or only new mail) and mail flows normally, delete the old folders:
rm -rf /var/spool/exim/input.old /var/spool/exim/msglog.oldKeeping them until then means you can still recover a genuine message if you need to. Send a test email in and out afterwards, and watch exim_mainlog for errors.
6. Keep it from happening again
- Limit sending per domain. In WHM, set an hourly limit in Tweak Settings (the maximum hourly emails per domain) and per hosting package. On DirectAdmin, set per-user sending limits. Pick a limit that fits normal use; a spammer then hits the ceiling instead of your IP reputation.
- Enable SMTP Restrictions in WHM's Security Center, so only the mail server and root can connect to outside mail servers. Scripts must then send through Exim, where limits and logs apply.
- Keep websites updated. Most script-based spam comes from outdated WordPress plugins, themes and contact forms. See why and how WordPress websites get hacked.
- Watch the queue. A monitoring check that alerts when
exim -bpcpasses a few hundred catches an outbreak early. - Check blocklists afterwards. If your server IP was listed during the outbreak, request removal from each blocklist once the source is fixed.
7. On Domain India hosting
On shared hosting, the server's mail queue is ours to manage, and each account has an outgoing limit: 200 messages per hour per account on cPanel and 1,000 per day on DirectAdmin. If you can receive but not send, read I can receive mail but I cannot send it. If you think your site or mailbox has been used to send spam, change your email passwords, follow the security checklist for hacked websites, and open a ticket.
On a Domain India VPS you are the administrator, and the VPS is self-managed. cPanel is not offered on our VPS; the control panel options at checkout include DirectAdmin, which uses Exim, so the commands above apply there (with the DirectAdmin log path).
- 2 vCPU
- 4 GB DDR4 RAM
- 128 GB NVMe SSD Storage
- 3 TB Monthly Bandwidth
Prices on the cards are live Domain India list prices and exclude 18% GST.
How do I count the emails in the Exim queue?
Run exim -bpc as root. It prints the number of messages waiting. exim -bp lists them, and piping that into exiqsumm summarises them by destination domain.
What is the fastest way to delete all messages from the Exim queue?
For a normal queue, run exiqgrep -i | xargs -r -n 1000 exim -Mrm. For a very large queue, stop Exim, move /var/spool/exim/input and msglog aside, recreate them with the same owner and permissions, and start Exim again.
How do I delete only the spam from one sender?
Run exiqgrep -i -f followed by the sender address, and pipe the IDs to xargs -r exim -Mrm. Use -r instead of -f to select by recipient, or -z to select frozen messages.
Why does the queue fill up again after I clear it?
The source is still sending. Find it in the Exim log, either a mailbox login (A=dovecot) or a script folder (cwd=), then change the password or disable the script before clearing the queue again.
Can I clear the mail queue on Domain India shared hosting?
No. The queue belongs to the whole shared server and only our administrators can manage it. Open a support ticket if your mail is stuck or you think your account is sending spam.
Does clearing the queue delete genuine emails?
Yes. Every message waiting in the queue is removed, including delayed real mail, and senders are not notified. Remove messages selectively by sender, recipient or age whenever you can.
Ready to take control of your own mail server? Compare VPS plans, or open a support ticket if you are on shared hosting and your mail needs attention.
Self-managed KVM VPS with full root access, with DirectAdmin available as a control panel option.
See VPS plans