{"id":806,"date":"2013-01-17T18:18:23","date_gmt":"2013-01-17T23:18:23","guid":{"rendered":"https:\/\/www.inmotionhosting.com\/support\/2013\/01\/17\/find-email-forwarders-or-autoresponders\/"},"modified":"2021-08-16T23:23:56","modified_gmt":"2021-08-17T03:23:56","slug":"find-email-forwarders-or-autoresponders","status":"publish","type":"post","link":"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/","title":{"rendered":"Find email forwarders or autoresponders"},"content":{"rendered":"

In this article I’m going to show you how to find email forwarders or autoresponders that your users have setup on your VPS (Virtual Private Server) or dedicated server.<\/p>\n

This is good information to know, as the sending reputation of your server’s IP address can be affected by the mailing activity of your users. It’s very typical that a user might simply be forwarding all of their email to another service such as AOL or Yahoo, and if they are sending too much mail to these services, or forwarding mail with characteristics of spam to these services, it can begin to affect the delivery of your other users on your server reaching those services in a timely manner.<\/p>\n

Also in some cases, autoresponders can be used for spamming purposes. For instance a spammer can forge the from address of a message they send to you, with the email address of the user they would like to spam, then your autoresponder will attempt to send to that forged from address. So knowing how to find excessive amounts of autoresponder replies can be helpful as well to help protect you server’s mail IP address reputation.<\/p>\n

Please note that in order to follow along with the steps below, you’ll need to have root access<\/a> on either your VPS or dedicated server so that you have access to the Exim mail log.<\/p>\n

Find users with the most email forwarders or autoresponders<\/h2>\n

Using the steps below I’ll walk you through finding which users on your server have the largest amount of either email forwarders or autoresponders getting sent out.<\/p>\n

    \n
  1. Login to your server via SSH<\/a> as the root user.<\/li>\n
  2. Run the following command to get the highest count of email forwarders or autoresponders:
    \ngrep \"=> .*@.*@.*\" \/var\/log\/exim_mainlog | awk '{print $6,$5}' | sort | uniq -c | sort -n<\/code>
    \nCode breakdown:<\/strong><\/p>\n\n\n\n\n\n
    grep “=> .*@.*@.*” \/var\/log\/exim_mainlog<\/th>\nLocate lines in the Exim mail log that indicate the message is not a normal delivery, and is either being forwarded or an autoresponder.<\/td>\n<\/tr>\n
    awk ‘{print $6,$5}’<\/th>\nUse the awk<\/strong> command to print out the $6<\/strong>th column which is the local email account, followed by the $5<\/strong>th column which is the email forward or autoresponder.<\/td>\n<\/tr>\n
    sort | uniq -c | sort -n<\/th>\nSort the users, then uniquely count them up, and finally sort them by lowest to highest.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    You should get back something that looks like this:
    \n1468 <webmaster@example.com> webmaster@gmail.com
    \n1499 <sales@example.com> sales@yahoo.com
    \n1554 <info@example.com> info@aol.com
    \n2479 user@example.com |\/usr\/local\/cpanel\/bin\/autorespond<\/code><\/p>\n

    In this case, we can see that the user@example.com<\/strong> user has had about 2,479<\/strong> autoresponder messages, and the info@example.com<\/strong> user had 1,554<\/strong> emails forwarded off to info@aol.com<\/strong>.<\/p>\n

    Now if you see there is a particular mail forwarder getting excessively used, you might want to consider disabling the forwarder. A better option would be to directly check the email account info@example.com<\/strong>, instead of having it forward all of the mail to the info@aol.com<\/strong>. This way you’re not flooding AOL with a lot of messages from your server automatically, possibly leading to them rate-limiting or even blacklisting your other users on the same server from mailing AOL users.<\/li>\n

  3. If as in our case, you notice one user like user@example.com<\/strong> has a ton of autoresponder replies going out, you can check to see what email addresses are sending into the account that are causing all of these.Run the following command to get a log of just that user’s mail activity:
    \ngrep user@example.com \/var\/log\/exim_mainlog > EMAIL_LOG<\/code>
    \nAfter you’ve got that email user’s activity saved to the EMAIL_LOG<\/strong> file, use the following command to parse each message ID for that user to determine what address originally sent the message that triggered the autoresponder:
    \nfor eximID in `awk '\/autorespond\/ {print $3}' EMAIL_LOG`; do grep $eximID EMAIL_LOG |
    \nawk '\/<=\/ {print $5}'; done | sort | uniq -c | sort -n<\/code>
    \nCode breakdown:<\/strong><\/p>\n\n\n\n\n\n\n
    for eximID in `awk ‘\/autorespond\/ {print $3}’ EMAIL_LOG`;<\/th>\nStart a bash<\/strong> for loop, where the variable eximID<\/strong> is getting set for lines that we’ve used the awk<\/strong> command to ensure they include the word autorespond<\/strong>, and the column getting printed is the $3<\/strong>rd one which is the Exim message ID. This loop will read through each line in our EXIM_LOG<\/strong> file.<\/td>\n<\/tr>\n
    do grep $eximID EMAIL_LOG<\/th>\nLocate the Exim message IDs with the $eximID<\/strong> variable from our EMAIL_LOG<\/strong> file.<\/td>\n<\/tr>\n
    awk ‘\/<=\/ {print $5}’<\/th>\nUse the awk<\/strong> command to look for incoming deliveries indicated by <=<\/strong>, then print out the $5<\/strong>th column of data which is the email address of the user sending the message in.<\/td>\n<\/tr>\n
    ; done | sort | uniq -c | sort -n<\/th>\nCompletes our for loop with the done<\/strong> command, the takes all of the data outputted and sorts it by the email addresses, uniquely counts them, and then sorts it from lowest to highest.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    You should get back something that looks like this:
    \n10 notification@facebookmail.com
    \n25 update@facebookmail.com
    \n28 sales@example.com
    \n2211 no-reply@example.com<\/code><\/p>\n

    So in this case we can clearly see that no-reply@example.com<\/strong> sent 2,211<\/strong> messages into the user@example.com<\/strong> account causing an excessive amount of autoresponder replies.<\/p>\n

    Now that you’ve looked at this data, you’ll want to go ahead and remove the EMAIL_LOG<\/strong> file we created with the following command:
    \nrm -rf EMAIL_LOG<\/code><\/li>\n<\/ol>\n

    You should now understand how to use the Exim mail log to track down users that are using excessive amounts of email forwarders or autoresponders.<\/p>\n","protected":false},"excerpt":{"rendered":"

    In this article I’m going to show you how to find email forwarders or autoresponders that your users have setup on your VPS (Virtual Private Server) or dedicated server. This is good information to know, as the sending reputation of your server’s IP address can be affected by the mailing activity of your users. It’s Read More ><\/a><\/p>\n","protected":false},"author":57014,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-806","post","type-post","status-publish","format-standard","hentry","category-email"],"acf":[],"yoast_head":"\nFind email forwarders or autoresponders | InMotion Hosting<\/title>\n<meta name=\"description\" content=\"In this article I'm going to show you how to find busy email forwarders or autoresponders that your users have setup on your VPS (Virtual Private Server) or dedicated server using the Exim mail log.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Find email forwarders or autoresponders | InMotion Hosting\" \/>\n<meta property=\"og:description\" content=\"In this article I'm going to show you how to find busy email forwarders or autoresponders that your users have setup on your VPS (Virtual Private Server) or dedicated server using the Exim mail log.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/\" \/>\n<meta property=\"og:site_name\" content=\"InMotion Hosting Support Center\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/inmotionhosting\/\" \/>\n<meta property=\"article:published_time\" content=\"2013-01-17T23:18:23+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-08-17T03:23:56+00:00\" \/>\n<meta name=\"author\" content=\"InMotion Hosting Contributor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/InMotionHosting\" \/>\n<meta name=\"twitter:site\" content=\"@InMotionHosting\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"InMotion Hosting Contributor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/\"},\"author\":{\"name\":\"InMotion Hosting Contributor\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644\"},\"headline\":\"Find email forwarders or autoresponders\",\"datePublished\":\"2013-01-17T23:18:23+00:00\",\"dateModified\":\"2021-08-17T03:23:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/\"},\"wordCount\":846,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\"},\"articleSection\":[\"Email\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/\",\"name\":\"Find email forwarders or autoresponders | InMotion Hosting\",\"isPartOf\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#website\"},\"datePublished\":\"2013-01-17T23:18:23+00:00\",\"dateModified\":\"2021-08-17T03:23:56+00:00\",\"description\":\"In this article I'm going to show you how to find busy email forwarders or autoresponders that your users have setup on your VPS (Virtual Private Server) or dedicated server using the Exim mail log.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.inmotionhosting.com\/support\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Find email forwarders or autoresponders\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#website\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/\",\"name\":\"InMotion Hosting Support Center\",\"description\":\"Web Hosting Support & Tutorials\",\"publisher\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.inmotionhosting.com\/support\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\",\"name\":\"InMotion Hosting\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg\",\"contentUrl\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg\",\"width\":696,\"height\":696,\"caption\":\"InMotion Hosting\"},\"image\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/inmotionhosting\/\",\"https:\/\/x.com\/InMotionHosting\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644\",\"name\":\"InMotion Hosting Contributor\",\"description\":\"InMotion Hosting contributors are highly knowledgeable individuals who create relevant content on new trends and troubleshooting techniques to help you achieve your online goals!\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/inmotion-hosting\/\",\"https:\/\/x.com\/https:\/\/twitter.com\/InMotionHosting\"],\"url\":\"https:\/\/www.inmotionhosting.com\/support\/author\/inmotion-hosting-contributor\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Find email forwarders or autoresponders | InMotion Hosting","description":"In this article I'm going to show you how to find busy email forwarders or autoresponders that your users have setup on your VPS (Virtual Private Server) or dedicated server using the Exim mail log.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/","og_locale":"en_US","og_type":"article","og_title":"Find email forwarders or autoresponders | InMotion Hosting","og_description":"In this article I'm going to show you how to find busy email forwarders or autoresponders that your users have setup on your VPS (Virtual Private Server) or dedicated server using the Exim mail log.","og_url":"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/","og_site_name":"InMotion Hosting Support Center","article_publisher":"https:\/\/www.facebook.com\/inmotionhosting\/","article_published_time":"2013-01-17T23:18:23+00:00","article_modified_time":"2021-08-17T03:23:56+00:00","author":"InMotion Hosting Contributor","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/InMotionHosting","twitter_site":"@InMotionHosting","twitter_misc":{"Written by":"InMotion Hosting Contributor","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/#article","isPartOf":{"@id":"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/"},"author":{"name":"InMotion Hosting Contributor","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644"},"headline":"Find email forwarders or autoresponders","datePublished":"2013-01-17T23:18:23+00:00","dateModified":"2021-08-17T03:23:56+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/"},"wordCount":846,"commentCount":0,"publisher":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#organization"},"articleSection":["Email"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/","url":"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/","name":"Find email forwarders or autoresponders | InMotion Hosting","isPartOf":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#website"},"datePublished":"2013-01-17T23:18:23+00:00","dateModified":"2021-08-17T03:23:56+00:00","description":"In this article I'm going to show you how to find busy email forwarders or autoresponders that your users have setup on your VPS (Virtual Private Server) or dedicated server using the Exim mail log.","breadcrumb":{"@id":"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.inmotionhosting.com\/support\/email\/find-email-forwarders-or-autoresponders\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inmotionhosting.com\/support\/"},{"@type":"ListItem","position":2,"name":"Find email forwarders or autoresponders"}]},{"@type":"WebSite","@id":"https:\/\/www.inmotionhosting.com\/support\/#website","url":"https:\/\/www.inmotionhosting.com\/support\/","name":"InMotion Hosting Support Center","description":"Web Hosting Support & Tutorials","publisher":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inmotionhosting.com\/support\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.inmotionhosting.com\/support\/#organization","name":"InMotion Hosting","url":"https:\/\/www.inmotionhosting.com\/support\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/","url":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg","contentUrl":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg","width":696,"height":696,"caption":"InMotion Hosting"},"image":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/inmotionhosting\/","https:\/\/x.com\/InMotionHosting"]},{"@type":"Person","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644","name":"InMotion Hosting Contributor","description":"InMotion Hosting contributors are highly knowledgeable individuals who create relevant content on new trends and troubleshooting techniques to help you achieve your online goals!","sameAs":["https:\/\/www.linkedin.com\/company\/inmotion-hosting\/","https:\/\/x.com\/https:\/\/twitter.com\/InMotionHosting"],"url":"https:\/\/www.inmotionhosting.com\/support\/author\/inmotion-hosting-contributor\/"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"primary_category":null,"_links":{"self":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/806","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/users\/57014"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/comments?post=806"}],"version-history":[{"count":3,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/806\/revisions"}],"predecessor-version":[{"id":85061,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/806\/revisions\/85061"}],"wp:attachment":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/media?parent=806"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/categories?post=806"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/tags?post=806"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}