Exim MTA queue management and cleanup with forensic-safe workflow

High Exim queue volume is not just a performance issue. It can indicate account compromise, malicious scripts, destination rejection, or IP reputation problems.

This workflow is inspection-first, deletion-second.

0) Conceptual failure that breaks queue operations

Incorrect command pattern:

exim -Mvh silvana@domain.com

-Mvh, -Mvb, and -Mrm require a Message-ID, not an email address. Use exiqgrep to map address -> queue IDs:

• recipient: exiqgrep -i -r silvana@domain.com
• sender: exiqgrep -i -f silvana@domain.com

-i is critical for ID-only output in automation pipelines.

1) Initial triage

exim -bp
exim -bp | exiqsumm
exim -bpc

Frozen messages:

exiqgrep -z -i

2) ID-level forensic inspection

exim -Mvh MESSAGE_ID
exim -Mvb MESSAGE_ID
exim -Mvl MESSAGE_ID

Validate sender identity, route, retention reason, and repetition pattern.

3) Selective cleanup patterns

By sender:

exiqgrep -i -f 'user@domain.com' | xargs -r exim -Mrm

By recipient:

exiqgrep -i -r 'target@otherdomain.com' | xargs -r exim -Mrm

Frozen only:

exiqgrep -z -i | xargs -r exim -Mrm

Force queue run:

exim -qff

Age-based cleanup (older than 7 days):

exiqgrep -i -o 604800 | xargs -r exim -Mrm

Emergency full purge (only after strict validation):

exiqgrep -i | xargs -r exim -Mrm

Pre-check summary by domain:

exim -bp | exiqsumm

4) Common incident patterns

1. compromised WordPress plugin abusing mail()
2. leaked SMTP credentials
3. RBL rejection loops
4. DNS failures causing permanent defers

Useful log pivots:

grep -i "cwd=/home" /var/log/exim_mainlog | tail -n 200
grep -i "A=dovecot_login" /var/log/exim_mainlog | tail -n 200
grep -i "rejected\|blacklist\|spam" /var/log/exim_mainlog | tail -n 200
grep 'silvana@domain.com' /var/log/exim_mainlog | tail -n 20

5) Recurrence prevention in WHM

• global hourly sending cap per domain
• per-account hourly relay cap
• credential rotation + MFA
• malware scan of web roots and user cronjobs

6) Acceptance checklist

1. queue returns to baseline
2. no abnormal regrowth in 24h
3. abuse source blocked
4. sending limits enforced
5. IP reputation monitored in RBLs

Effective Exim queue handling is a process, not a single delete command. Forensic triage plus selective actions keeps legitimate mail flow intact.

This post is licensed under CC BY-NC.