Who is -remote- user?

[mtylerb]

I have had a lot of outgoing emails by user listed as -remote- in WHM. Who is this and how can I stop these? I've attached a screenshot from WHM's Mail Sent Summary page. That is a 3 month period and the 2000+ emails are a problem.

 

[quietFinn]

Click the word "-remote-" to show a detailed report.

 

[mtylerb]

Ok, I assumed that Mail "Sent" Summary meant it was emails SENT from the server. All the emails in this are emails received from remote to local accounts. Am I to guess then that these are essentially SPAM messages coming in, for the most part? That I don't need to worry that they are accessing my server illegitimately and sending SPAM messages? My queued mail is 0, so I am 95% sure that I'm not sending SPAM.

 

[kdean]

While there may be a lot of SPAM, -remote- emails are all emails coming into the server from a remote email address so they can be valid emails being sent to your accounts as well.

 

[mtylerb]

Ok, so I understood the purpose of Mail Sent Summary wrong. I am aware of the volume of incoming SPAM. Much of it is caught by the RBLs that are set up. Even more are to accounts that don't actually exist.

Thanks for the help guys.

 

[quietFinn]

Ok, so I understood the purpose of Mail Sent Summary wrong. I am aware of the volume of incoming SPAM. Much of it is caught by the RBLs that are set up. Even more are to accounts that don't actually exist.

Thanks for the help guys.

The "View Sent Summary" shows emails that are sent from your server (either from an account in your server or through your server).
When you click the user (for ex. -remote-) it shows "messages sent from and received by your server".
If you then want to see messages sent by that user, you select "Delivery type: Sent Emails" and click "Run report".

In the search report you see a list of "Senders", that are "remote". If you look at the recipients, the email address is either a "local" address, which means that it is in "Sent Emails" because that address is forwarded to an external address, or if that address is a "remote" address it means that someone ("-remote-") has sent to that address through your server.