Automatically block account based on deferred messages

[workflux]

Hi,

I've noticed that invariably, when a client's email account gets compromised by virus/password theft, and starts sending SPAM, the "deferred messages" count of the domain goes to the roof.
This causes me problems because my IPs get blocked by anti-SPAM lists and subsequently other clients complain.

So I was thinking if there's a way to automatically detect if an account is getting a high number of deferred messages in order to block specific e-mail account or send me an alert about it to manually react to the fact.

It would be great if it can be done through CPanel or if somebody share's a cron job to do it but in case nobody's done it, my questions are only:

1.- Where can I PROGRAMATICALLY check the deferred messages count that appears on "View Sent Summary"?

2.- Is there a way to check (also programatically) what is the offending account (or accounts)?

Thank you in advance for any help!

 

[ruzbehraja]

Have you used:

WHM >> Tweak Settings:

Maximum percentage of failed or deferred messages a domain may send per hour
The maximum percentage of a domain’s outgoing mail that can consist of failed or deferred messages. Once the domain exceeds this percentage, it is temporarily blocked from sending mail.

• Unlimited default
• %

and

Number of failed or deferred messages a domain may send before protections can be triggered

 

[workflux]

Hi, thank you very much for your response. I've actually tried tightening that parameters but it blocks whole domains and generates more problems. I'd love to be able to block individual offending accounts through "exim custom rules" but I need access to the number of deferred messages and can't find the correct place to get it.

 

[workflux]

Hi, any additional info about this? Just had the problem with another account and it again sent deferrals to the roof. Preventing that per e-mail account would be a great tool against outgoing SPAM.

 

[cPanelMichael]

Hello,

The data you are looking for is found in the "defers" table in the "eximstats" database. You can use the emailtrack_stats WHM API 1 function if you want to obtain this data:

WHM API 1 Functions - emailtrack_stats - Software Development Kit - cPanel Documentation

You can also vote and add feedback to the existing feature request for this at:

Mail sending limits per email account (rather than per domain)

Thanks!