Delete mail queue In Qmail

Objective

Sometimes we get spam issue with Qmail. The Spammer is able to get the account's password and continuously Relay mails to whole world via this Server . In that case thousands of mail will be in queue.

Methodology for Detection and permanent fix

1. First Find the Queue status
2. Then find out who is spamming
3. Then find out what account is Compromised .
4. Then Change the password for that account or delete the account if not required .
5. Then delete all the mails which has been generated by this spammer
6. Check the log for no more successful attempts of that spammer.
7. Check the Damage done in the reputation of outgoing IP via mxtools.com
8. Possibly , if there are multiple IP's available change the outgoing IP

Process

First stop qmail

vim /etc/inittab

SV:123456:respawn:/command/svscanboot

# out above line end of file

init q

For get help of qmHandle

qmHandle -h

To know which user account has been compromised. this command shows which user sending maximum mail.

qmHandle -l |grep From:|sort|uniq -c|sort -nr|head

Or can use below for same purpose

qmHandle -l|less

get message ID

qmHandle -m'message ID'|less

Please check in header file which user account compromised.

Change password for it first and delete mail in queue.

You can delete mail from queue using different option to from qmHandle -h (help)

For example

qmHandle -h'Subject: limited offer'

above command will delete all messages in queue that have Subject: limited offer

Note:-> Please never apply above commands before stop qmail(mentioned above).