When Your Server Sends Spam: Finding the Source and Getting Off Blacklists on cPanel

When a cPanel server starts sending spam, it is almost always for one of two reasons: an email account whose password was stolen, or a malicious script (often in a hacked website) that sends mail through PHP. Either one can get your server's IP address listed on public blocklists, and then legitimate invoices, quotes and replies start bouncing or landing in spam. The fix is to stop the sending first, find the exact source in the Exim mail logs, clean up the account or site, and only then request removal from the blocklists. This guide explains each step and the WHM settings that make it less likely to happen again.

How a business server ends up sending spam

Compromised email accounts

Attackers collect email passwords through phishing, password reuse from other breaches, or guessing weak passwords. With a valid mailbox password they can log in to your server's SMTP service and send large volumes of mail that looks like it comes from a legitimate user. Because they authenticate, these messages pass through your server like normal mail.

Malicious or vulnerable scripts

The second common cause is code on a website. An outdated plugin, an abused contact form or an uploaded backdoor can send mail directly through PHP. These messages do not use a mailbox login at all, which is why they can be harder to spot.

Why it affects everyone on the server

Receiving mail servers judge reputation largely by the sending IP address. On a cPanel server, many accounts usually share one outbound IP, so one hacked mailbox can hurt the deliverability of every business on that server. Proper SPF, DKIM and DMARC records do not prevent this, because the spam really is coming from your server.

Warning signs to watch for

• Customers say your emails are not arriving, or you receive bounce messages for mail you never sent.
• The mail queue in WHM is unusually large or full of messages to unknown recipients.
• Your server's IP or domain shows up on a blocklist lookup such as Spamhaus.
• WHM sends a notification that an account has hit a sending limit or was flagged as a potential spammer.
• Server load jumps without a matching increase in website traffic.

Step 1: Stop the outbound flood

Speed matters, because every hour of spam makes the listing worse.

1. Identify the likely account (Step 2 explains how) and, as a quick containment step, restrict or suspend outgoing email for that cPanel account or mailbox (cPanel and WHM both offer this), or change the mailbox password.
2. Review the mail queue. WHM's Mail Queue Manager lets you search the queue by sender or recipient and delete messages. cPanel's documentation warns that "delete all" removes everything in the queue, so filter by the offending sender instead of wiping legitimate mail.
3. Do not reboot and hope. Restarting services does not remove the cause; the spam will resume.

Step 2: Find the source in the Exim logs

cPanel servers use Exim as the mail server, and its main log is /var/log/exim_mainlog. cPanel's support article on finding the source of spam describes the core logic:

• Authenticated mailbox: messages sent by a logged-in user show an authentication entry such as A=dovecot_login:[email protected] on the line where the message arrives (marked <=). If one address shows a large number of these logins, especially from unfamiliar IP addresses or countries, that mailbox is compromised.
• Script-sent mail: if a message has no mailbox authentication, it was probably sent by a script. Exim records the current working directory (cwd=) of the process that submitted the message. A high count of messages coming from a folder under a user's home directory, such as a plugin or upload folder, points to the script responsible.

Helpful places to look in WHM:

• Mail Delivery Reports (called Track Delivery in cPanel) show recent deliveries and failures by sender and recipient.
• Mail Queue Manager shows what is waiting and who sent it.
• cPanel's X-Source headers (the "Track email origin via X-Source email headers" setting, on by default) add the origin of each message to its headers, which helps when you have a copy of a spam message.

If the logs do not show enough detail, cPanel's article explains how to raise Exim's logging level temporarily and check again after some hours.

Step 3: Clean up the actual cause

If a mailbox was compromised

1. Reset the password to a long, unique one and sign out of all devices that use it.
2. Check the mailbox for new forwarders, filters or autoresponders the attacker may have added.
3. Find out how the password leaked. If the user fell for a phishing page, other passwords may be exposed too.
4. Turn on multi-factor authentication for webmail and email clients where your platform supports it.

If a script was sending mail

1. Locate the files in the directory shown in the logs and remove the malicious code. Run a full malware scan of the account (for example with Imunify360 or ImunifyAV if your server has it).
2. Update or remove the vulnerable plugin, theme or form that was abused.
3. Change the cPanel, FTP and database passwords for that account, and the website's admin passwords.
4. Check for backdoors elsewhere in the account. Attackers often leave more than one file, and a deleted script that reappears means something is still recreating it.

Step 4: Request removal from blocklists

Only ask for delisting after the spam has stopped; otherwise you will be relisted quickly.

1. Look up your server's outbound IP address and your domain on check.spamhaus.org, the Spamhaus reputation checker. The result tells you which list you are on and why.
2. Follow the removal instructions on each listing record. Spamhaus delisting is free; do not pay third parties to "remove" you.
3. Check other blocklists that major mail providers use, and watch for bounces over the following days. Some listings expire on their own once the spam stops.

Step 5: Prevent it from happening again

WHM includes several settings under Tweak Settings > Mail that limit the damage from a compromised account. cPanel's documentation lists, among others:

Setting	What it does	Default
Max hourly emails per domain	Caps how many emails each domain can send per hour	Unlimited
Maximum percentage of failed or deferred messages a domain may send per hour	Blocks outgoing mail when too many messages fail	Unlimited
Monitor the number of unique recipients per hour to detect potential spammers	Flags users who suddenly email many different recipients	On (500 recipients)
Action when a potential spammer is detected	Take no action, hold outgoing mail, or reject outgoing mail	Take no action
Prevent "nobody" from sending mail	Stops the generic web server user from sending to remote addresses	On

Practical recommendations:

• Set realistic hourly limits per domain (and per package) that fit your normal sending. Bulk newsletters belong on a dedicated email marketing service, not on your web server.
• Choose an action for potential spammers. "Hold outgoing mail" stops the damage while you investigate.
• Keep SMTP Restrictions enabled (WHM > Security Center > SMTP Restrictions), so only the mail server, Mailman and root can connect to remote mail servers directly and scripts cannot bypass Exim.
• Protect mailbox logins. Strong unique passwords, brute-force protection (cPHulk or Imunify360) and user training against phishing do more than any filter.
• Keep websites updated and scanned, since hacked sites are the other main source of outbound spam.

Let us check your mail server

If your emails have started bouncing, or you are not sure how your cPanel server would cope with a hacked mailbox, Core Florida IT can investigate, clean up and configure sensible limits. We support businesses across Miami-Dade and South Florida, with remote support nationwide. Request a free IT assessment to get started.

Sources

• cPanel Support: How to find the source of spam emails
• cPanel & WHM Documentation: Tweak Settings, Mail
• cPanel & WHM Documentation: SMTP Restrictions
• cPanel & WHM Documentation: Mail Queue Manager
• Spamhaus: IP and Domain Reputation Checker