How much mail your account sends

Outgoing mail is easy to forget about until it goes wrong. This screen shows, per domain, what went out, what is still waiting and what never arrived — and it warns you when a domain suddenly sends far more than it usually does, which almost always means something has been taken over.

There are two places to find it:

• Your own hosting — open your account and go to Email → Report. You see your own domains and nothing else.
• The whole server (operators) — Insights → Mail volume. Every domain on the machines you may operate, busiest first.

The period switcher at the top offers 24 hours, 7 days or 30 days.

The three numbers

Two more columns follow those three: Received, and Refused. Refused mail is mail turned away at the door — spam, an address that does not exist here, a block — and it is incoming. It is deliberately not counted under "not delivered", because it was never mail your domain tried to send. That is why the columns do not add up to one number.

Under the table there is a What these words mean section. Open it and all five words are explained where you are reading them, each in the colour the table uses for it.

Held back is not a failure. Every hosting account has a ceiling on outgoing mail, so that one compromised website cannot get the whole server's address onto a blocklist. Over the ceiling, the rest waits and is delivered afterwards. If you see a large number here day after day, your ceiling is too low for what you do — ask your hosting provider to raise it.

Beside the hourly ceiling there is a per-minute cap on mail a script sends: a contact form, a shop confirming orders, a cron job. Sending by hand from webmail never touches it. It exists because a compromised website spends a whole hour's budget in seconds, and that burst is exactly what receiving providers react to.

The "sending far more than usual" message

A yellow or red line sometimes appears above the table. It compares a domain with itself: how much it sent this hour, against what it normally does in an hour. A newsletter of a thousand messages an hour is not an alarm if that domain always does that, and a quiet domain that suddenly sends two hundred is.

The line names who was sending:

• the address, and how many messages;
• the file that produced the mail, when a script did it — for example 1043:kv.php. The number in front is your account's system user;
• the login and the address it came from, when somebody signed in to send.

Do you not recognise it? Then something has been taken over. Two things help at once:

1. Change the password of the mailbox it names. A stolen password is the most common cause, and it keeps going for as long as the password works.
2. Find the file it names in your website and remove it — see the next section.

Finding the file

The message names the file without a directory: PHP writes the file name and your account's user number and nothing more. Search from your own home, with the web terminal or over SSH:

$ find ~/domains -name 'kv.php'
/home/customer/domains/example.com/public_html/wp-content/uploads/kv.php

Upload directories have no business running PHP. If you find a file there that you do not recognise, remove it and update your CMS and its plugins straight away — the file is the consequence, not the cause. If you are not sure, leave it where it is and ask your hosting provider about it; the file is the evidence.

If the web terminal is not for you, the same search works in the file manager: open Files, go to the domain's directory and search for the name.

Your mail keeps working in the meantime: a sending limit holds back outgoing mail and nothing else. Your website, your databases and your incoming mail are untouched, and your account is never suspended for sending too much.

Finding one domain in a long list

Above the table are a search box and, for an operator, a server picker.

• Type part of a domain name and press Show. The search happens on the server, over all your domains — not only over the ones that happen to be on screen, which matters as soon as you have more domains than the table shows.
• The picker limits the report to one machine. It offers the mail servers you may look at and nothing else.

Both end up in the address bar, so a narrowed report is a link you can paste into a message to your hosting provider. Under the title you can read what is being shown ("limited to server … and domains matching …"), and Clear filter puts everything back. If the table is empty it says which of the two it is: nothing has been sent yet, or nothing matches your filter.

What an operator sees on top of this

On Insights → Mail volume, beside the domains, there is a line for every server whose mail queue is filling up or growing fast. That is the other half of the same incident: the mail a compromised site sends is mail that piles up. What is waiting, and the buttons to do something about it, are under The mail queue.

The thresholds are settable under Settings: how many times its own average a domain may send, how many messages an hour must carry before that counts, and the two thresholds of the queue.

Where to find this, and how to get back

The report for your own account is under Accounts → your account → Mail report. Above the title is your account's name as a way back: one click and you are on the account page you came from. If you get a notification about outgoing mail, the link in it takes you straight to this report with the domain already filled in — and the way back is there too.

There is a second copy of the same page under Insight → Mail volume. That one shows every domain on the platform and is there for the administrator; you see nothing of anybody else's there.