Guide CyberPanel Mail Queue: Fix Stuck Emails, Find Spam Senders, Check Blacklists

Guide CyberPanel Mail Queue: Fix Stuck Emails, Find Spam Senders, Check Blacklists - Printable Version

+- AdminsForum (https://adminsforum.com)
+-- Forum: Free & open-source control panels (https://adminsforum.com/Forum-free-open-source-control-panels)
+--- Forum: CyberPanel (https://adminsforum.com/Forum-cyberpanel)
+---- Forum: CyberPanel Guides & Tutorials (https://adminsforum.com/Forum-cyberpanel-guides-tutorials)
+----- Forum: CyberPanel Email Guides (https://adminsforum.com/Forum-cyberpanel-email-guides)
+----- Thread: Guide CyberPanel Mail Queue: Fix Stuck Emails, Find Spam Senders, Check Blacklists (/Thread-guide-cyberpanel-mail-queue-fix-stuck-emails-find-spam-senders-check-blacklists)

CyberPanel Mail Queue: Fix Stuck Emails, Find Spam Senders, Check Blacklists - JAY - 10-26-2026

CyberPanel Mail Queue: Fix Stuck Emails, Find Spam Senders, Check Blacklists

"My emails aren't arriving" usually ends in one of three places: the mail is stuck in your server's queue, something on the server is sending spam, or your IP is on a blacklist. CyberPanel 3.0 has a free Mail Queue page for the first one. For the other two we used a few SSH commands. We tested all of it on our own CyberPanel server.

A quick note before you start: in the Email menu, Email Limits (per-mailbox sending limits) and Email Debugger are paid add-ons. On our free install both links opened the CyberPanel add-ons sales page instead of a settings page. Mail Queue is free and works.

What the queue is
When your server can't hand a message to the receiving server right away, Postfix keeps it in the queue and tries again for up to five days. Messages marked deferred are waiting for another try; the reason is shown next to each one. A few deferred messages are normal. Hundreds usually mean a problem.

See the queue
To have something to look at, we held outgoing mail for a minute and sent three test messages to example.com. From SSH,

Code:

postqueue -p

lists them:

Code:

postqueue -p

Each entry shows the queue ID, size, time, sender, recipient, and in brackets the reason (ours said

Code:

(deferred transport)

, because we held it on purpose). Common real reasons are

Code:

Connection timed out

(port 25 blocked by your provider or the other side is down),

Code:

451 4.7.1 Try again later

(greylisting or rate limiting at the receiver) and

Code:

Host not found

(a typo in the domain).

How we held it, if you want to practise:

Code:

postconf -e 'defer_transports = smtp'; systemctl reload postfix
# send a few test messages to an address @example.com
postconf -X defer_transports; systemctl reload postfix

The last line puts it back to normal. Don't forget it, or no mail leaves your server.

The Mail Queue page in CyberPanel
Open Email > Mail Queue (

Code:

https://YOUR-SERVER-IP:8090/emailPremium/mailQueue

).
The same three messages on the Mail Queue page:
[Image: attachment.php?aid=500]

View Message opens the full queue file: envelope, sender, client, headers and body:
[Image: attachment.php?aid=501]

The buttons:

Refresh: reload the list. After a delete, the table kept showing the old rows until we clicked Refresh, although the panel said "Successfully deleted" and the queue was already empty from SSH.
Flush Queue: try to deliver everything now (from SSH:
Code:
postqueue -f
). Use it after you fixed the cause, for example after your provider opened port 25.
Delete Deferred: removes only messages waiting for a retry (from SSH:
Code:
postsuper -d ALL deferred
). We used this one; all three test messages were gone.
Delete All: empties the whole queue, including mail that is about to go out. Only for a spam flood.

From SSH you can delete one message instead of all:

Code:

postsuper -d QUEUEID

.

Is a mailbox or website sending spam?
If the queue suddenly fills up, find out who is sending. This counts senders in today's log:
[Image: attachment.php?aid=534]

Code:

Ours showed our own test senders at the top. On a hacked server you see one address with hundreds or thousands of messages. Then:

If it's a mailbox, its password was guessed or leaked. Change it in Email > Change Password and delete its spam from the queue.
If it's the website user or an address like
Code:
[email protected]
, a form or a plugin is being abused (or the site is infected). Check the site, update plugins, add a captcha to forms. See where CyberPanel keeps its logs.

CyberPanel's free version has no per-mailbox sending limit (that's the paid Email Limits add-on), so this check is your early warning. Run it now and then, or after a "your server is sending spam" mail from your provider.

Are you on a blacklist?
A blacklist (DNSBL) is a list of IPs that sent spam. You check it with a DNS lookup of your IP written backwards. We did this on the server:

Code:

IP=$(hostname -I | awk '{print $1}')
REV=$(echo $IP | awk -F. '{print $4"."$3"."$2"."$1}')
dig +short $REV.zen.spamhaus.org
dig +short $REV.bl.spamcop.net

No output means "not listed"... but not always.
Blacklist checks from the server itself can lie. Here is what our server returned:
[Image: attachment.php?aid=535]

To test the test, we looked up

Code:

127.0.0.2

, an address every blacklist lists on purpose. SpamCop answered

Code:

127.0.0.2

(listed, so the check works). Spamhaus answered NXDOMAIN, as if even its test address were clean. The reason was in

Code:

/etc/resolv.conf

: our server uses Google's public DNS (

Code:

8.8.8.8

), and Spamhaus doesn't answer queries that come through big public resolvers. So an empty Spamhaus result from such a server tells you nothing.

What to do instead:

Check your IP on the blacklist websites themselves (Spamhaus has a free IP lookup page; MXToolbox and similar tools check many lists at once).
Always run the
Code:
127.0.0.2
test first, so you know the lookup works.
If you use SpamAssassin or Rspamd to filter incoming mail, the same problem means their Spamhaus checks may silently do nothing on a server that uses public DNS.

If you are listed, fix the cause first (the spam check above), then use the delisting form on that blacklist's site. Most lists remove you within a day once the spam stops.

Common problems

Everything to Gmail/Outlook is deferred with "Connection timed out": outgoing port 25 is blocked. Test:
Code:
timeout 6 bash -c '</dev/tcp/gmail-smtp-in.l.google.com/25' && echo OPEN || echo BLOCKED
. Ask your provider to open it.
Bounces you never sent fill the queue (sender
Code:
<>
, MAILER-DAEMON): spammers used your domain as the fake sender, or a catch-all accepted spam. See our catch-all notes.
Mail is delivered but lands in spam: queue is fine, check SPF, DKIM and DMARC: CyberPanel email setup.
Mail logs: there was no
Code:
/var/log/mail.log
on our Ubuntu 24.04 server; use
Code:
journalctl -t postfix/smtp -n 50
.

More CyberPanel guides

Tested on CyberPanel 3.0 (build 8, OpenLiteSpeed edition) on Ubuntu 24.04, October 2026. Menu names can change slightly between versions.