Turkey (Turkish)
Germany (German)
Worldwide (English)
Submission serviceExim SMTP acceptance and delivery processes
Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
When Exim service is down or SMTP connections are stuck, emails cannot be sent, the queue grows, and cPanel chkservd generates an alert. This guide diagnoses service, port 25, intense connections, spamming accounts, PHP scripts, spool, DNS, and delivery problems without silencing messages.
The “exim” service appears to be down.
421 Too many concurrent SMTP connections
Message is frozen
Connection timed out: SMTP timeout while connected to remote host
Failed to create spool file: Permission deniedExim is the default email transfer service on cPanel servers. It accepts incoming SMTP connections, delivers to local mailboxes, and sends to external servers. Chkservd Exim control may send a service closed notification if it cannot respond.
Exim may be really closed; however, when intense simultaneous SMTP connections are rejected or delayed, it may appear as if the service is running but down.
Mail queue growth is not Exim failure alone. Remote server's temporary rejection, DNS issue, port 25 block, incorrect recipients or spam messages can accumulate in retry state.
A spam source is categorized into two main groups: email accounts compromised via SMTP AUTH and PHP scripts on a website generating messages via local sendmail. The authenticated_id, cwd, and U fields in the logs help distinguish the source.
SPF, DKIM, and DMARC affect delivery reliability; however, if the service has not started, the Exim startup, spool, disk, permissions, and configuration layer must be resolved first.
Bulk-deleting the mail queue may temporarily reduce disk and load, but it conceals the spam source, misdirection, or remote delivery issue. Analyze the sender, recipient, error, and production method first.
Search for the phrase you see in the email, browser, or SSH log. Each card includes meaning, probable cause, and safe initial action.
Meaning: cPanel Exim service or SMTP health check could not be verified.
Possible cause: Service is closed, high connection, port is not listening, spool/disk issue or configuration error.
Meaning: Exim has reached the allowed simultaneous connection limit for the same source or total connections.
Possible cause: Spam bot, compromised account, bulk sending or low link limit.
Meaning: The server was unable to complete the TCP 25 connection to the remote SMTP server.
Possible cause: Provider has outbound 25 limit, firewall, route or remote access restrictions.
Meaning: The target SMTP port is actively rejecting the connection.
Possible cause: Remote service is closed, incorrect MX, firewall reject or Exim is not listening locally.
Meaning: Exim cannot write the queue file to the spool directory.
Possible cause: Incorrect permission/ownership, read-only filesystem, disk or inode issue.
Meaning: Exim cannot create a new queue or log file
Possible cause: /var disk space or inode full, excessive queue/spam.
Meaning: Exim has stopped automatic redelivery of the message and has frozen it.
Possible cause: Permanent delivery error, bounce creation failure, incorrect sender, or long retry period.
Meaning: The next retry time for the remote target has not yet arrived.
Possible cause: Previous temporary delivery error and Exim retry plan.
Meaning: Exim has written critical operation or configuration errors to paniclog.
Possible cause: Router/transport error, permission, lookup, spool or custom config issue.
Meaning: This message may have been generated by a web site/PHP process via local sendmail.
Possible cause: Contact form, malicious attachment, harmful PHP file, or spam script.
Meaning: There is failed or suspicious SMTP authentication traffic for an account.
Possible cause: Brute force, leaked password, incorrect device settings, or botnet.
Meaning: The remote server has permanently rejected the message due to policy or reputation.
Possible cause: Missing DNS records, blacklisting, spam content, incorrect PTR/HELO or low reputation.
No records matching this expression were found.
Commands are for root access. Collect only status and logs first; Do not change the permanent setting without seeing the reason.
/usr/local/cpanel/scripts/restartsrv_exim --status
systemctl status exim -l --no-pagerShows Exim's status as seen by cPanel and systemd
ss -lntp | grep -E ':(25|465|587)\b'Shows whether Exim is listening on its SMTP, SMTPS, and submission ports
exim -bpc
exim -bp | exiqsumm | head -n 80It summarizes total queue count, size, age, and domain distribution.
exim -Mvh MESSAGE_ID
exim -Mvb MESSAGE_ID
exim -Mvl MESSAGE_IDDisplays the message header, body, and delivery log separately.
tail -n 200 /var/log/exim_mainlog
tail -n 100 /var/log/exim_rejectlog
tail -n 100 /var/log/exim_paniclogDelivers delivery, return, identity verification, and critical Exim errors.
ss -ntp | grep -E ':(25|465|587)\b' | awk '{print $5}' | sed 's/:[^:]*$//' | sort | uniq -c | sort -nr | head -n 30Lists remote IP addresses that open the most SMTP connections.
grep 'cwd=/home/' /var/log/exim_mainlog | tail -n 200
grep -o 'cwd=/home/[^ ]*' /var/log/exim_mainlog | sort | uniq -c | sort -nr | head -n 30Finds account and working directories of generated message from web directories.
dig +short MX ALICI_DOMAIN
nc -vz -w 8 MX_HOST 25
traceroute -T -p 25 MX_HOST 2>/dev/null | tail -n 20Test DNS MX resolution and remote SMTP connection path.
First, determine whether Exim is listening, then separate the queue reason, spam source, network access, and DNS/reputation layer.
Exim process, 25/465/587 ports, /var area, and inode status are the first control.
/usr/local/cpanel/scripts/restartsrv_exim --status
ss -lntp | grep -E ':(25|465|587)\b'
df -hT /var
df -ih /varInstead of the general error given by the restart script, read the paniclog and mainlog lines simultaneously.
tail -n 150 /var/log/exim_paniclog
tail -n 200 /var/log/exim_mainlogDetermine with exiqsumm and example message log which domain, age and error are grouped around.
exim -bp | exiqsumm
exim -Mvl MESSAGE_IDIf SMTP AUTH is enabled, change the related password and check the devices; if it's a PHP script, isolate the account and file and perform a virus scan.
grep 'auth_id=' /var/log/exim_mainlog | tail -n 100
grep 'cwd=/home/' /var/log/exim_mainlog | tail -n 100Check outbound port 25, recipient MX, PTR, HELO, SPF, DKIM and DMARC records according to full error response.
dig +short MX ALICI_DOMAIN
nc -vz -w 8 MX_HOST 25After the root cause is resolved, start Exim with the cPanel script and force the queue to run once. Do not delete the error messages collectively.
/usr/local/cpanel/scripts/restartsrv_exim
exim -qff
exim -bpcAuthenticated_id or auth_id is visible in the log. Password is immediately changed, connected devices are cleaned, active sessions are terminated, and a sending limit is applied.
grep -Ei 'auth_id=|A=dovecot_login:' /var/log/exim_mainlog | tail -n 200The cwd=/home/... line and message ID are monitored. The file is quarantined, the web account is scanned, CMS/plugins are updated, and access logs are reviewed.
grep 'cwd=/home/' /var/log/exim_mainlog | tail -n 200If a connection timeout occurs for multiple independent MXs, the data center outbound 25 block may be the cause. It can be opened by the provider or an authorized smarthost can be used.
for h in gmail-smtp-in.l.google.com mx1.hotmail.com; do nc -vz -w 8 $h 25; doneFirst, identify the common sender, domain, and error cause of frozen messages. Selectively clean invalid bounce or spam messages; do not clear the entire queue.
exiqgrep -z -i | head -n 50
exim -bp | exiqsummFull SMTP response; evaluated for IP reputation, PTR/HELO, SPF/DKIM/DMARC, content or speed limit.
grep ' 550 ' /var/log/exim_mainlog | tail -n 100Indicates that cPanel's Exim process or SMTP health check could not be verified. The service may be closed or the check may be rejected due to excessive connections.
exim -bpc shows total message count, exim -bp shows queue list, and exim -bp | exiqsumm shows age, size, and domain summary.
Active connections are identified by source IP and authenticated users. Spam, hijacked accounts, or mass submissions are stopped; limits are set only after real traffic is validated.
If multiple reliable remote MXs constantly time out with nc -vz HOST 25 test, there may be an outbound blockage. Firewall and data center policies are checked.
Exim automatic retry message. It can be caused by a permanent error, bounce issue, or long retry process; the message log should be read before deletion.
Exim mainlog records with cwd=/home/... and message ID are tracked. The file path, user, and time access logs are matched.
No. You may lose valid customer messages. First, identify common error and spam sources, and selectively clean only verified unwanted messages.
Usually not a service failure; IP reputation, PTR/HELO, SPF, DKIM, DMARC, content, and sending behavior issues. Delivery headers should be examined.
By analyzing cPanel, WHM, CloudLinux, LiteSpeed, MariaDB, Exim and security layers together, we fix the root cause of the failure instead of just removing the service.