DE

↑ ↓ select, Enter open, Esc close

Find the top senders in the Postfix queue

harmlessMaildebian, ubuntu
user@server
postqueue -p | awk '/^[0-9A-Za-z]/ {print $7}' | sort | uniq -c | sort -rn | head -20

Analyzes the queue and lists sender addresses by number of waiting messages. A single address at the top with hundreds of entries is usually a hacked mailbox or an abused contact form. Empty senders (bounces) appear as MAILER-DAEMON.

Also searched as

  • server is sending spam
  • who is clogging the mail queue
  • thousands of emails in queue

Related one-liners

All in Mail

Delete all mail from one sender in the Postfix queue

#postqueue -p | awk -v s="info@example.com" '/^[0-9A-Za-z]/ && $7 == s {print $1}' | tr -d '*!' | postsuper -d -
destructiveMail

Delete all deferred mail from the Postfix queue

#postsuper -d ALL deferred
destructiveMail

Find a hacked mail account by its SMTP logins

#grep -o "sasl_username=[^ ,]*" /var/log/maillog | sort | uniq -c | sort -rn | head -20
harmlessMail

Flush the Postfix queue and retry delivery now

$postqueue -f
cautionMail

Show the Postfix mail queue

$postqueue -p
harmlessMail

Trace local PHP mail sending to a system user

#grep "postfix/pickup" /var/log/maillog | grep -o "uid=[0-9]*" | sort | uniq -c | sort -rn | head -10
harmlessMail

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.