Fixing a Stalled Exim Mail Queue and Clearing Frozen Spool Files on cPanel/WHM

If you manage a cPanel or WHM server with multiple client accounts, sooner or later a compromised WordPress script or rogue email account will flood Exim with tens of thousands of messages. When the queue balloons into the tens of thousands, the WHM Mail Queue Manager interface in the browser will often time out or take forever to load.

When that happens, jumping straight into SSH and managing Exim directly from the terminal is the fastest way to get things moving again. Here are the commands and one-liners I use to clear out stuck queues and get mail flowing normally.

---

1. Check the Mail Queue Count & Current Activity

First, see how many messages are waiting in line:

exim -bpc

To see what Exim is actively doing right this second:

exiwhat

If you want a breakdown of which domains or email addresses have the most messages queued:

exim -bp | exiqsumm

Inspecting domain volume and message age breakdown using exiqsumm

---

2. Deleting All Frozen Messages in One Shot

Most spam and bounce-back floods end up flagged as frozen. You can purge all frozen messages from the queue instantly with this one-liner:

exiqgrep -z -i | xargs exim -Mrm

Running exiqgrep to extract frozen message IDs and pipe to exim -Mrm for removal

---

3. Deleting Messages from a Specific Sender or Domain

If a single compromised email account (e.g. spammer@example.com) generated thousands of queued emails:

# Search by sender and delete all matching message IDs:
exiqgrep -f "spammer@example.com" -i | xargs exim -Mrm

# Or search by recipient domain:
exiqgrep -r "badtargetdomain.com" -i | xargs exim -Mrm

---

4. Resetting the Spool Directory if Exim is Completely Frozen

If the queue has hundreds of thousands of entries and Exim is completely locked up refusing to process valid mail, you can move the jammed spool files aside and let Exim start fresh:

# Stop Exim cleanly
/scripts/restartsrv_exim --stop

# Move old spool aside (don't delete outright until verified)
mkdir /root/old_exim_spool
mv /var/spool/exim/input/* /root/old_exim_spool/
mv /var/spool/exim/msglog/* /root/old_exim_spool/

# Restart Exim
/scripts/restartsrv_exim --start

Once Exim starts with a clean spool directory, it will immediately resume processing regular user mail without choking.

For more cPanel server email maintenance, take a look at my one-liner for enabling SPF and DKIM records across all cPanel domains, accessing WHM without a root password using the API, or testing inbox deliverability with mail-tester deliverability checks. Official command line references can also be found in the cPanel Mail Queue Documentation.