Find SPAM senders in WHM
There are useful tools within WHM/cPanel to view recent emails sent from the server and also messages currently waiting to be sent in the outgoing email queue. To use these tools, look for Mail Delivery Reports and Mail Queue Manager within the Email section of WHM.
- Login to WHM.
- Search for the Email section using the search bar in the top left corner of WHM. Select Mail Delivery Reports, choose a date range and select Run Report.
- Once the report has processed, you can see the email delivered during the requested date range. Select the From Address header to sort the report and find a sender that may be sending unusual amounts of email.
- If mail is not being sent and is building up in the email queue, select the Mail Queue Manager in WHM's Email section. Select a date range and click Run Report.
- Once the report has processed, you can see the mail queue during the requested date range. Select the From Address header to sort the report and find a sender that may be sending unusual amounts of email.
Review your report
When reviewing these reports, look for a large amount of mail coming from a single sender, and take actions to stop that mail from being sent.
- Excessive emails from a recognized email account on the server may indicate the password has been compromised. To combat this, update the password of the affected account to a strong, random password.
Excessive emails to a recognized forwarding account on the server may indicate that this forwarding account is being flooded with mail. This can cause the server to be blocked from sending any mail to the destination (like Gmail). We recommend removing any email forwarding accounts from the server as they can be easily abused. - Scripts can also be the cause of SPAM. See how you can enable PHPMail logging using WHM.
- Take steps to prevent SPAM issues on your server.
- Return to review email spam issues on your server.
- Our server experts can perform these steps for a fee. For more information about our Expert Services, please visit our Expert Service menu.
Excessive emails from [cpanelusername]@[server.host.name] are being sent from a script within a particular cPanel account. This could be a misconfigured CMS or a malicious file.
Excessive emails from root@[server.host.name] are being sent from a root process on the server, such as alerts from WHM or CSF. Check the mail settings of any application you've installed and these areas of WHM to make sure the server is sending all notifications to valid email addresses:
Basic WebHost Manager® Setup Edit System Mail Preferences Contact Manager Email All Resellers Email All Users
