Diagnosing Stuck Exim Mail Queues in cPanel

Emails sent from a cPanel server can remain stuck in the Exim mail queue with statuses such as deferred or retrying. Exim is the mail transfer agent (MTA) that cPanel uses to route and deliver email. This condition usually means Exim accepted a message but cannot finish delivery to the remote server. The useful takeaway is to isolate whether the failure is local—DNS, mailbox quota, or firewall—or external, such as recipient rejection or upstream filtering, before forcing the queue to flush.

Recognizing the Condition

Run the queue listing from the server terminal. You need root or sudo access because Exim queue files and logs are typically owned by a privileged user.

exim -bp

Look for messages that have remained in the queue for hours or days. The table below maps common queue states to likely causes and the first check to run.

Queue state	Likely cause	First check
Deferred for hours	Incorrect MX records, full recipient mailbox, or temporary remote rejection	dig mx example.com +short
Retrying repeatedly	Outbound port 25 blocked or network timeout to the remote host	telnet smtp.example.com 25
Specific address fails	Invalid recipient, sender block, or authentication failure	grep "[contact removed]" /var/log/exim_mainlog
Local delivery fails	Mailbox over quota	maildirstat /home/username

Ordered Checks

1. Inspect the Exim queue

Where: Server terminal via SSH.

Permissions: Root or sudo.

Command:

exim -bp

Expected result: A list of message IDs, senders, recipients, and time in queue. If the list is empty, Exim has no pending mail.

Risk: Read-only; no delivery state changes.

2. Search the Exim main log for a failing recipient

Where: Server terminal.

Permissions: Root or sudo; /var/log/exim_mainlog is usually readable only by root or the mail group.

Command:

grep "[contact removed]" /var/log/exim_mainlog

Expected result: Lines showing the delivery attempt and an SMTP error code, such as 550 (mailbox unavailable or user unknown), 451 (temporary local error), or Connection timed out.

Risk: Read-only.

3. Verify public MX records

Where: Any terminal; you do not need to run this on the cPanel server.

Permissions: None special.

Command:

dig mx example.com +short

Expected result: One or more MX records pointing to the correct mail server IP or hostname. Missing or outdated records explain inbound delivery failures.

Risk: Read-only. DNS changes require propagation time, which can range from minutes to 48 hours depending on TTL.

4. Test outbound SMTP connectivity on port 25

Where: Server terminal.

Permissions: Root or sudo may be needed to install or run network tools.

Command:

telnet smtp.example.com 25

If telnet is unavailable, use nc -zv smtp.example.com 25.

Expected result: A successful connection shows a 220 SMTP banner. A hang or Connection refused indicates a firewall rule, ISP block, or provider restriction on outbound port 25.

Risk: Read-only.

5. Check local mailbox quota

Where: Server terminal for command-line inspection, or cPanel for the account interface.

Permissions: Root or sudo to inspect another user's mailbox; account owner can check via cPanel.

Command:

maildirstat /home/username

If maildirstat is not installed, use cPanel under Email Accounts > Manage Usage to view quota and disk usage.

Expected result: Mailbox usage below the assigned quota. A full mailbox causes Exim to defer local delivery.

Risk: Read-only.

Fixes Tied to Findings

Apply only the fix that matches the diagnostic result. Do not change global Exim settings unless a check points to a configuration error.

• Incorrect MX records: Update the MX records in cPanel Zone Editor or with your DNS host. Confirm propagation with dig mx example.com +short before testing delivery again.
• Full mailbox: Increase the quota in WHM under Account Functions > Modify Account, or in cPanel under Email Accounts > Manage Usage. Archive or delete old messages to reduce usage.
• Port 25 blocked: Contact your hosting provider or ISP to request outbound port 25 access. As an alternative, configure Exim to use a smarthost on port 587 or 465 through WHM Exim Configuration Manager. This affects all outbound mail, so review the smarthost credentials and test carefully.
• Exim configuration error: Correct the setting in WHM Exim Configuration Manager. Test on a staging account first because global changes affect every domain on the server.

Flush the queue only after the cause is fixed

Once delivery can succeed, force Exim to process the pending messages:

exim -qff

Permissions: Root or sudo.

Risk: This changes delivery state. If the root cause is not fixed, messages may bounce repeatedly or generate duplicate delivery attempts. There is no undo for messages already flushed from the queue.

Verify the Result

1. Run mailq again. The queue count should decrease and reach zero for the affected domain.
2. Send a test email through cPanel Webmail or with mail -s "Delivery test" [contact removed] < /dev/null.
3. Check /var/log/exim_mainlog for a completed delivery entry and confirm no retry loop appears for the same recipient.
4. Confirm DNS with dig mx example.com +short if you changed MX records.

Escalation Criteria

• The queue exceeds 10,000 messages or remains stuck for more than 24 hours after applying fixes.
• Logs show authentication failures with an upstream mail provider; contact that provider.
• Repeated 550 or 554 errors from a specific domain suggest a blocklist issue; contact the recipient administrator or open a cPanel support ticket.

Limitations

• This guide applies to Exim on cPanel/WHM. It does not cover third-party mail gateways or servers without Exim.
• maildirstat may not be installed by default; use the cPanel interface as an alternative.
• DNS propagation delays mean a corrected MX record may not work immediately.
• Queue inspection and log reading are safe read-only operations. Queue flushing and Exim configuration changes alter mail delivery state and should be done only after confirming the cause.