hostdoc — offline cPanel/WHM/WHMCS support brain

← all runbooks

---
title: Email is not arriving at the other end
panel: cPanel / WHM
symptoms:
  - recipients say they never got it
  - mail arrives in spam
  - mail arrives but marked as suspicious
  - email goes straight to spam
  - marked as spam by gmail
  - blocked by the recipient mail server
  - rejected for spam policy
  - blocked on a blocklist
  - the other side never received it
---

# Email is not arriving at the other end

## 1. Prove it was accepted before you chase filters

**Why:** most of this call is spent on the receiving side when the mail
never got that far. A defer with a reason code is a naming or policy
problem at the far end. A clean accept means the message arrived and
something after that threw it away, which is a completely different
investigation.

**In WHM:** Email > Mail Delivery Reports. Open the message and read the
status line.

**In the terminal:** `grep -i <domain> /var/log/exim_mainlog`

**Care:** this only reads.

- https://docs.cpanel.net/whm/email/mail-delivery-reports/

## 2. Check all three authentication records

**Why:** SPF says which servers may send as the domain, DKIM signs the
message and says it was not tampered with, and DMARC says what to do when
those two disagree. A sender that has two of the three is usually fine.
A sender with one is usually the problem, and the fix is a record rather
than anything on the server.

**In cPanel:** Email > Email Deliverability. The current records and the
recommended ones are shown side by side.

**In WHM:** Email > Email Deliverability > Deliverability by Domain.

**In the terminal:** `dig +short TXT <domain>` and
`dig +short TXT <selector>._domainkey.<domain>`

**Care:** a DKIM record is a TXT record at a subdomain name, not on the
domain itself. It is easy to add it in the wrong place and easy to add a
second one, which invalidates the first.

- https://docs.cpanel.net/whm/dns-functions/enable-dkim-spf-globally/
- https://docs.cpanel.net/whm/scripts/the-spf_installer-script/

## 3. Check what the receiving filter is doing

**Why:** spam filters on the receiving end act on the sending IP, the
sending hostname, the authenticated user and the content. If the customer
is sending to a domain on your own server and that mail is being
filtered, the blocklist is the place to look rather than the DNS.

**In cPanel:** Email > Global Email Filters.

**In the terminal:** `cat /var/cpanel/userdata/<user>/main` and look for
the filter and blocklist settings.

**Care:** this only reads.

- https://docs.cpanel.net/knowledge-base/email/how-to-create-a-spam-email-filter/

## 4. Check the account's own sending limits

**Why:** a mailer that has been disabled, or an account that has hit a
limit, stops sending with nothing obvious in the queue. It is a quick
check that saves chasing the wrong end.

**In WHM:** Email > Mail Delivery Reports, filter by the account and look
for a reason code that names a limit rather than a rejection.

**In the terminal:** `grep -i -E "too many|quota|blocked" /var/log/exim_mainlog`

**Care:** this only reads.

- https://docs.cpanel.net/cpanel/email/email-disk-usage/
- https://docs.cpanel.net/knowledge-base/email/how-to-keep-your-email-out-of-the-spam-folder/