How to Clear the Exim Mail Queue: Remove All Messages (Updated 2026)

Managing the Exim mail queue is one of the most common tasks for any Linux system administrator running a mail server. A backed-up queue can cause delivery delays, consume disk space, and — in spam situations — get your server's IP blacklisted. This guide covers every scenario: checking the queue, removing individual messages, clearing everything at once, and tracking down the spam source.

1. What Is the Exim Mail Queue?

Exim is the default Mail Transfer Agent (MTA) on most cPanel/WHM Linux servers. When an email cannot be delivered immediately — because the recipient's mail server is down, busy, or rejecting connections — Exim holds the message in a mail queue and retries delivery at intervals. 

Under normal conditions, this queue should be small (under 100 messages). A queue with thousands of messages usually means one of two things:

• A downstream mail server is unreachable or rate-limiting you.
• A compromised script or user account is sending spam from your server.

Either way, you need to act fast. Let's go through the commands.

2. Check the Queue Size

The quickest way to see how many messages are waiting:

exim -bpc

This returns a single number — the total count of messages currently in the queue. If this number is in the hundreds or thousands unexpectedly, investigate immediately using the steps below.

3. List All Messages in the Queue

To see a detailed list of all queued messages including message ID, age, size, sender, and recipient:

exim -bp

Example output looks like this:

 2h  3.0K 1sXk7t-0003yK-00 <sender@example.com>
           recipient@domain.com
 5m  1.2K 1sXkAb-0004mP-00 <newsletter@mysite.com>
           user@gmail.com

The columns are: age in queue, message size, message ID, sender, and recipient.

4. Remove a Single Specific Message

Once you have the message ID from exim -bp, you can delete a specific message without touching the rest of the queue:

exim -Mrm {message-id}

Example:

exim -Mrm 1sXk7t-0003yK-00

The -Mrm flag stands for Message Remove. Exim will confirm the deletion with a message like Message 1sXk7t-0003yK-00 has been removed.

5. Clear the Entire Queue at Once

When you need to wipe the entire queue — for example, after a spam attack floods it with thousands of messages — use this one-liner:

exim -bp | awk '/^ *[0-9]+[mhd]/{print "exim -Mrm " $3}' | bash

What this command does:

1. exim -bp — lists all queued messages.
2. awk '/^ *[0-9]+[mhd]/{print "exim -Mrm " $3}' — extracts each message ID and constructs a remove command for it.
3. | bash — executes each remove command immediately.

Alternative method using exiqgrep (cleaner syntax):

exiqgrep -i | xargs exim -Mrm

exiqgrep -i outputs only message IDs, and xargs passes them all to the remove command. This is slightly faster on very large queues.

6. Remove Only Frozen Messages

Exim "freezes" messages it cannot deliver after several attempts. Frozen messages sit in the queue indefinitely and don't retry. To remove only frozen messages while leaving active messages alone:

exiqgrep -z -i | xargs exim -Mrm

The -z flag filters for frozen messages only. This is the safe option when you want to clean up stuck messages without disrupting legitimate mail that's still being retried.

7. Freeze and Unfreeze Messages

Sometimes you need to temporarily stop Exim from retrying delivery (e.g., while you fix a DNS or relay issue) without permanently deleting the messages.

Freeze all queued messages:

exiqgrep -i | xargs exim -Mf

Thaw (unfreeze) all frozen messages:

exiqgrep -i | xargs exim -Mt

Force an immediate retry on all queued messages:

exim -qff

The -qff flag forces a queue run and attempts delivery on all messages, including frozen ones. Useful after fixing a delivery problem.

8. Find the Source of Spam

If your queue suddenly fills with thousands of messages, a compromised web application or user account is almost always the cause. This command analyzes the Exim main log and shows you which directories are generating the most outbound mail:

grep cwd /var/log/exim_mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n

Example output:

   3 /home/user1/public_html
  12 /home/user2/public_html/wp-content/plugins/contact-form
4821 /home/user3/public_html/uploads/old-plugin

In this example, user3's uploads directory is generating 4,821 emails — a clear sign of a compromised file (often an old plugin or a PHP shell uploaded by an attacker). Immediately:

1. Suspend the account or disable the directory.
2. Remove the malicious file.
3. Clear the spam from the queue using the method in Section 5.
4. Check your server's IP against blacklists at MXToolbox Blacklist Check.

9. Remove Messages by Sender Address

If you want to remove all queued messages from a specific sender address without touching the rest of the queue:

exiqgrep -i -f sender@example.com | xargs exim -Mrm

Replace sender@example.com with the actual sender address you want to target.

Similarly, to remove all messages going to a specific recipient:

exiqgrep -i -r recipient@example.com | xargs exim -Mrm

Quick Reference: Exim Queue Commands

Frequently Asked Questions

Q: I ran exim -bpc and it shows 0 but mail is still not being delivered. What is wrong?

An empty queue with delivery failures means the problem is at the receiving end, not yours. The remote mail server may be rejecting your server's IP (blacklisted), refusing the connection, or returning a permanent failure (5xx) that caused Exim to bounce the message immediately rather than queue it. Check your mail logs at /var/log/exim_mainlog for 5xx error codes.

Q: Is it safe to run these commands on a live production mail server?

The read commands (exim -bpc, exim -bp) are completely safe on a live server. The delete commands are permanent and irreversible — only run them when you are certain you want to delete those messages. Never run the full queue clear command during normal business hours unless it's an emergency (spam flood).

Q: Where are Exim queue files stored on disk?

Exim stores its queue in /var/spool/exim/input/. Each message has two files: a header file (-H) and a data file (-D). You can see them directly with ls /var/spool/exim/input/ but always use the Exim commands above to manage them — never delete these files manually.

Q: My queue shows messages stuck "frozen" for days. What should I do?

First, check why they are frozen by viewing the message details: exim -Mvl {message-id}. Common reasons include permanent delivery failures (bad recipient addresses), authentication errors, or messages that were manually frozen. If they are legitimate messages to a temporarily unreachable server, thaw and retry with exim -qff. If they are spam or bounces, remove them with exiqgrep -z -i | xargs exim -Mrm.

Q: How can I prevent my Exim queue from filling up with spam in the future?

The best preventative measures are: keep all web applications and plugins updated, use a Web Application Firewall (WAF), disable PHP mail() for directories that don't need it, enable Exim's per-domain and per-account rate limiting in WHM, and monitor your queue size daily with a cron job that alerts you if it exceeds a threshold.

Have a question or a scenario not covered here? Leave a comment below and I will add it to the FAQ.