Who is -remote- user?

mtylerb

Well-Known Member
Nov 10, 2007
57
0
56
Warburg, AB, Canada
cPanel Access Level
Root Administrator
I have had a lot of outgoing emails by user listed as -remote- in WHM. Who is this and how can I stop these? I've attached a screenshot from WHM's Mail Sent Summary page. That is a 3 month period and the 2000+ emails are a problem.

screenshot.png
 

quietFinn

Well-Known Member
Feb 4, 2006
1,222
87
178
Finland
cPanel Access Level
Root Administrator
Click the word "-remote-" to show a detailed report.
 

mtylerb

Well-Known Member
Nov 10, 2007
57
0
56
Warburg, AB, Canada
cPanel Access Level
Root Administrator
Ok, I assumed that Mail "Sent" Summary meant it was emails SENT from the server. All the emails in this are emails received from remote to local accounts. Am I to guess then that these are essentially SPAM messages coming in, for the most part? That I don't need to worry that they are accessing my server illegitimately and sending SPAM messages? My queued mail is 0, so I am 95% sure that I'm not sending SPAM.
 

kdean

Well-Known Member
Oct 19, 2012
365
56
78
Orlando, FL
cPanel Access Level
Root Administrator
While there may be a lot of SPAM, -remote- emails are all emails coming into the server from a remote email address so they can be valid emails being sent to your accounts as well.
 

mtylerb

Well-Known Member
Nov 10, 2007
57
0
56
Warburg, AB, Canada
cPanel Access Level
Root Administrator
Ok, so I understood the purpose of Mail Sent Summary wrong. I am aware of the volume of incoming SPAM. Much of it is caught by the RBLs that are set up. Even more are to accounts that don't actually exist.

Thanks for the help guys.
 

quietFinn

Well-Known Member
Feb 4, 2006
1,222
87
178
Finland
cPanel Access Level
Root Administrator
Ok, so I understood the purpose of Mail Sent Summary wrong. I am aware of the volume of incoming SPAM. Much of it is caught by the RBLs that are set up. Even more are to accounts that don't actually exist.

Thanks for the help guys.
The "View Sent Summary" shows emails that are sent from your server (either from an account in your server or through your server).
When you click the user (for ex. -remote-) it shows "messages sent from and received by your server".
If you then want to see messages sent by that user, you select "Delivery type: Sent Emails" and click "Run report".

In the search report you see a list of "Senders", that are "remote". If you look at the recipients, the email address is either a "local" address, which means that it is in "Sent Emails" because that address is forwarded to an external address, or if that address is a "remote" address it means that someone ("-remote-") has sent to that address through your server.
 
Last edited: