I have Cpanel on a centos server having Exim as an MTA. The issue I am facing is that I have more that 100 users and their passwords are leaked most of time and then someone from our external network uses my exim to send thousand of Spam emails and gets my IP blacklisted.

Now what I want is that to restrict IPs in exim so that only specific users can connect to exim through their outlook or Thunderbird and send email.

  • Are you sure you are fixing the right problem? "Passwords are leaked most of the time" sounds like a persistent security hole, and you are just "pumping out water". Oct 13, 2014 at 13:20
  • Are these users always going to have predictable IPs? This seems like a nightmare to try and manage. Perhaps you could experiment with rate limiting within exim. Oct 13, 2014 at 23:13
  • @DeerHunter You are right. This is big security concern but as we have above 450 users so after every few weeks any ID's password is leaked by filling any spam form by user or any other way and then the ID is used for spam emails and IP gets blacklisted. So to fight this I am trying to restrict outlook connection within my office only.
    – Waqas Khan
    Oct 14, 2014 at 4:28
  • @theterribletrivium your solution is good but seems the spammers know that we are off Sat and they start sending campaign on Saturday and Sunday so till Monday emails become thousand in number..
    – Waqas Khan
    Oct 14, 2014 at 5:05
  • @theterribletrivium can I restrict user dependent "rate limit". For instance user A can send 100 emails and User B can send 500 emails.
    – Waqas Khan
    Oct 14, 2014 at 6:50

1 Answer 1


I was able to find this example repeated a few times in regards to exim4 rate limiting:

ratelimit = 100 / 1d / strict / $authenticated_id.

More details are available here: exim4 Section 42.38

The above example would limit each user to 100 emails per day. You can likely make per user rules for specific accounts that you expect to send more messages. It's not a perfect solution but it may help prevent you from being blacklisted at least.

Not the answer you're looking for? Browse other questions tagged .