Spammers

This page explains the Spammers screen in GoAdmio. It lets you control outbound email volume per user, throttle server-wide sending speed, and configure how often the server checks for spam activity — so a compromised or abusive account cannot flood the server's mail queue or damage its sending reputation.

Location: Admin Panel → Security → Spammers

Overview

A spammer in hosting terms is usually not a malicious customer — it is a compromised mailbox or script sending bulk email through your server. This can:

• Get your server IP blacklisted — a single spam run can block all email from the server for days or weeks
• Exhaust the mail queue — delaying legitimate email for every customer
• Trigger abuse complaints — from recipients, ISPs, and anti-spam services
• Damage the provider's reputation — affecting deliverability for all accounts

> Note: The Spammers page works alongside Outgoing Email Sending Limits (per-account limits) and Custom SMTP Relay (route mail through a trusted relay). Together they form a defense-in-depth approach to email abuse.

What the Page Shows

| Field | Description |
|---|---|
| Max hourly emails per user | The maximum number of emails a single user can send per hour |
| Server Send 1 Email Every | A server-wide throttle — one email sent every N seconds |
| Tracking Every | How often the server checks for spam activity |
| Search | Filter by account or domain (if the page lists per-account data) |

> Tip: The three settings control three different layers: per-user volume, server-wide rate, and monitoring frequency. All three should be tuned together.

Max Hourly Emails Per User

Caps the number of messages a single user (mailbox) can send per hour.

| Option | When to use |
|---|---|
| Unlimited emails per hour | Only for trusted internal accounts (e.g., transactional systems you control) |
| 5 emails per hour | Very restrictive — for personal mailboxes or accounts you suspect |
| 10–20 emails per hour | Typical for small business mailboxes |
| 25–50 emails per hour | Busy business mailboxes |
| 55–60 emails per hour | High-volume legitimate senders |

> Warning: Setting the limit too low will block legitimate email — a business sending invoices, a newsletter, or a notification system will hit the cap quickly. Set a limit high enough for the account's normal usage but low enough to stop a spam run.

> Tip: Start with 50 per hour for most accounts. Adjust based on customer complaints and spam incidents.

Server Send 1 Email Every

Throttles the server's overall sending rate — one email sent every N seconds, across all accounts.

| Option | Effective rate | When to use |
|---|---|---|
| No Delay (Recommended) | As fast as the server can send | Default; use when the server is healthy and reputable |
| 10 Seconds | 6 emails/minute | Mild throttling during abuse incidents |
| 20 Seconds | 3 emails/minute | Moderate throttling |
| 30 Seconds | 2 emails/minute | Strong throttling |
| 40 Seconds | 1.5 emails/minute | Very strong throttling |
| 50 Seconds | 1.2 emails/minute | Severe throttling |
| 1 Minute | 1 email/minute | Emergency throttling during an active spam run |

> Warning: This is a server-wide throttle. It slows email for every account, not just the abusive one. Use it only temporarily during an incident — not as a permanent setting.

> Tip: If you need to slow a specific account, use Outgoing Email Sending Limits or lower that account's limit on this page. The server-wide throttle is a blunt instrument for emergencies.

Tracking Every

Controls how often the server scans for spam activity.

| Option | When to use |
|---|---|
| Disable SPAM Tracking | Only if you have other spam protection (relay, external filter) |
| 1 Hour | Recommended — catches spam runs quickly |
| 2–3 Hours | Reduced server load, slower detection |
| 4–6 Hours | Minimal monitoring, for low-traffic servers |

> Tip: 1 Hour is the best balance — frequent enough to catch a spam run before it causes damage, but not so frequent that it burdens the server.

> Warning: Disable SPAM Tracking means GoAdmio will not detect spam activity automatically. Only disable it if you have a reliable external spam filter or SMTP relay handling abuse detection. See Custom SMTP Relay and Global SMTP Relay.

Recommended Configuration

| Setting | Recommended value | Why |
|---|---|---|
| Max hourly emails per user | 50 | Stops spam runs without blocking legitimate business email |
| Server Send 1 Email Every | No Delay (Recommended) | The server is healthy by default; throttle only during incidents |
| Tracking Every | 1 Hour | Fast detection, reasonable load |

> Tip: Review these settings after every spam incident. If an account sent 500 emails before detection, the limit or tracking interval was too loose.

How Spam Detection Works

When tracking runs, GoAdmio checks each account's sending activity for:

• Volume anomalies — an account sending far more email than usual
• Recipient patterns — many recipients at once, or recipients that bounce
• Content signals — subject lines or bodies matching spam patterns (if content scanning is enabled)
• Bounce rate — a high percentage of undelivered addresses
• Complaint signals — reports from external providers (if integrated)

• Throttle the account's sending
• Notify the administrator (see Notification Settings)
• Suspend the account's email (if configured)

Responding to a Spam Incident

If you detect a spam run — or GoAdmio flags an account:

1. Identify the source — use /go/mailtop to see the most active accounts, or check the Spammers page if it lists per-account data.
2. Throttle the server — temporarily set Server Send 1 Email Every to 10 Seconds or 20 Seconds to slow the flood.
3. Block the account — lower the account's Max hourly emails per user to a very low value, or suspend the account's email (see Suspend Account).
4. Change the account's password — the mailbox is likely compromised. See Password Modification.
5. Clean the mail queue — remove queued spam. See Email Tracking and the mail queue manager.
6. Check for blacklisting — see if the server's IP has been blacklisted. Use an MXToolbox-style check or /go/checkmail.
7. Notify the customer — inform them their account was compromised and password was reset.
8. Restore the throttle — once the spam run stops, return Server Send 1 Email Every to No Delay.

Related Commands

| Command | Purpose |
|---|---|
| /go/mailtop | Identify the most active email accounts |
| /go/undelivered | Manage bounced and undelivered mail |
| /go/checkmail | Verify port 25 is open |
| /go/checkdkim | Verify DKIM records |
| /go/checkmx | Check MX priority ranges |
| /go/iptop | Identify top IPs by traffic |

See Command Reference for the full CLI list.

Related Pages

• Outgoing Email Sending Limits — per-account sending caps
• Email Accounts — manage mailboxes
• Email Tracking — monitor delivery activity
• Undelivered Emails — bounced addresses
• Custom SMTP Relay — route mail through a trusted relay
• Global SMTP Relay — server-wide relay
• Brevo API — Brevo integration
• SPF / DKIM — email authentication
• Password Modification — reset a compromised account's password
• Suspend Account — suspend an abusive account
• Notification Settings — alerts on large outbound email volume
• IP Blocker — block abusive IPs
• Service Status — verify mail services are running

Troubleshooting

| Problem | Likely cause | Solution |
|---|---|---|
| Legitimate email is blocked | The hourly limit is too low for the account's usage | Raise Max hourly emails per user |
| Spam is still being sent despite limits | The spammer uses a different account, or the limit is too high | Lower the limit; identify the source with /go/mailtop |
| Server-wide throttle is slowing all email | Server Send 1 Email Every is set too low | Set to No Delay after the incident |
| Spam detection is not catching abuse | Tracking disabled, or the interval is too long | Set Tracking Every to 1 Hour |
| Too many false positives | The spam detection threshold is too aggressive | Adjust the limit; whitelist trusted accounts if your version supports it |
| Mail queue is full | A spam run has queued many messages | Clean the queue via the mail queue manager or Email Tracking |
| Server IP is blacklisted | A spam run already went out | Request delisting from the blacklist operator; fix the source first |
| Customer complains their emails are delayed | Server-wide throttle, or the hourly limit is too low | Raise the limit; set Server Send 1 Email Every to No Delay |
| Spammers page shows no data | No spam detected, or tracking disabled | Verify Tracking Every is enabled |

Best Practices

| Practice | Why |
|---|---|
| Set a reasonable hourly limit | Stops spam runs without blocking legitimate email |
| Keep server throttle at No Delay by default | The throttle affects every customer |
| Enable spam tracking | Automatic detection prevents silent spam runs |
| Review spam incidents | Every incident reveals a weakness in the configuration |
| Change the compromised account's password | The spam run is usually a result of a compromise |
| Monitor bounces | High bounce rates signal list abuse; see Undelivered Emails |
| Use SPF, DKIM, DMARC | Authentication reduces the likelihood of spam and improves deliverability |
| Notify customers of limits | Sets expectations and reduces complaints |
| Combine with SMTP relay | Relays handle volume and reputation better than direct sending |
| Document incidents | Helps identify recurring attackers or compromised accounts |