Why Exim updates matter

Exim is the mail server that sends and receives email on every cPanel server. It listens on the internet, so a security flaw in Exim can expose the whole server. Several serious Exim vulnerabilities have been found over the years, and attackers scan for unpatched servers quickly. Keeping Exim current is one of the most important updates on a cPanel server.

How cPanel delivers Exim updates

cPanel builds and ships its own Exim package. Security fixes arrive through the normal cPanel update process, usually within a short time of an Exim release. You should not install Exim from source or from another repository on a cPanel server: cPanel would overwrite it, or mail could stop working.

Step 1: check your current version

exim -bV | head -n 1
/usr/local/cpanel/cpanel -V      # cPanel version

Compare the Exim version with the latest security announcements from cPanel and Exim. If a security release is out and your server does not have it yet, update now.

Step 2: check your cPanel update settings

In WHM, open Server Configuration > Update Preferences. Make sure cPanel updates are set to Automatic on a release tier such as Release or Stable, and that operating system package updates are also automatic. With these settings, Exim fixes install during the nightly update.

Step 3: update now

Run the updates as root, inside screen in case your connection drops:

screen -S update

# Full cPanel update, including Exim
/scripts/upcp

# Or check and repair cPanel-managed Exim packages only
/scripts/check_cpanel_pkgs --fix --targets=exim

upcp can take several minutes. Its log is in /var/cpanel/updatelogs/.

Step 4: restart Exim and confirm

/scripts/restartsrv_exim
exim -bV | head -n 1
systemctl status exim --no-pager

Step 5: test mail delivery

# Check how Exim would route an address
exim -bt someone@example.com

# Watch the log while you send a test message
tail -f /var/log/exim_mainlog

Send a message from a webmail account to an external address, and reply to it, so you test both directions. In WHM, Email > Mail Delivery Reports shows whether messages were accepted.

Keep your Exim configuration safe

• Change Exim settings in WHM’s Exim Configuration Manager, not by editing /etc/exim.conf. cPanel rebuilds that file during updates.
• Before you change advanced settings, use the backup option in Exim Configuration Manager, so you can restore the previous configuration.
• Custom settings added in the Advanced Editor are kept across updates.

After an Exim security release

• ✓ Confirm the new version with exim -bV.
• ✓ Check the mail queue for unexpected messages with exim -bpc.
• ✓ Review the logs for unusual activity. See our guide to finding the source of spam.
• ✓ Make sure the firewall allows only the mail ports you use.

Troubleshooting