Limits and notifications for emails from 'nobody'


Active Member
Apr 19, 2019
cPanel Access Level
Root Administrator
I currently have "prevent 'nobody' from sending mail" enabled. I enabled mod_evasive and have proper config to send emails. However, as mentioned in ModEvasive Sending Email Alerts mod_evasive being an apache module is run under the same user as apache which is 'nobody' so of course, emails from mod_evasive are being rejected.

Looking at the code, there is no obvious way to allow an exception for mod_evasive or somehow enable it to send email in some other way. If I disable "prevent 'nobody' from sending mail" as suggested, are emails sent by 'nobody' still bound to the mail limits set in WHM->Tweak Settings->Mail such as max hourly emails, notifications on max number of emails/day, monitoring number of unique recipients/hour, and the rest.

I'm using mod_suexec so it's unlikely scripts on any accounts will be sending as 'nobody' since suexec forces them to run as the account user. I realize with suexec the chances of 'nobody' abusing mail are slim. I just want to ensure if 'nobody' does get out of control there are limits and notifications in place. Thanks.


Staff member
Apr 11, 2011
Hello @kdub,

Email limits are not enforced for emails sent from the "nobody" username by default. However, the following option is available under the Mail tab in WHM >> Exim Configuration Manager >> Basic Editor:

Trust X-PHP-Script headers to determine the sender of email sent from processes running as nobody

Per it's description:

If the MailHeaders patch is installed in EasyApache, cPanel will use the X-PHP-Script to determine the sender of a message for Email Archiving and Limits.

The MailHeaders PHP patch is installed by default as part of the core PHP installation in EasyApache 4. EX:

# /opt/cpanel/ea-php70/root/usr/bin/php -i|grep mail.add_x_header
mail.add_x_header => On => On

# /opt/cpanel/ea-php72/root/usr/bin/php -i|grep mail.add_x_header
mail.add_x_header => On => On
Let me know if this helps.

Thank you.
  • Like
Reactions: kdub