Website Sending Spam Emails? When Your Host Says You Are Spamming

Higher-risk issue — be cautious and consider professional help sooner.

Your host says your account is sending spam, your outgoing email has been blocked or limited, or your website is sending spam emails you never wrote — something is using your domain's mail system to send junk.

Common signs of this issue

• Your host emails you that your account or website is sending spam emails, and outgoing mail has been suspended, limited, or queued.
• You receive piles of bounce-back messages for emails you never sent, to people you have never heard of.
• Your normal emails suddenly start bouncing or landing in spam, and a blacklist check shows your domain or server IP listed.
• Customers or contacts tell you they got strange emails that appear to come from you.
• Your hosting dashboard shows email usage far above normal, or a warning about hitting the hourly sending limit.
• Your website contact form is suddenly busy with submissions full of links, and copies are going out to strangers.

Safe checks you can do yourself

None of these require sharing passwords with anyone.

• Read the host's notice carefully and reply asking for details. Hosts can usually see which mailbox logged in to send, or which script or folder on the website generated the mail. That one fact tells you which of the three main causes you are dealing with.
• Look at a few of the bounce-back messages. Open one and find the original message inside it. Note the From address, the subject, and — if you can see the full headers — whether it passed through your host's servers. Spam that never touched your server is spoofing, not a break-in.
• In your hosting control panel, look for an email delivery or tracking tool (in cPanel it is often called Track Delivery). Check which address is sending the most mail and at what times. A single mailbox sending thousands of messages overnight points strongly at a stolen password.
• Change the password on any mailbox that looks involved, and on every other mailbox on the domain if you are unsure. Use a long, unique password for each, and turn on two-factor authentication wherever your email provider offers it. Then update the password on phones and laptops so they keep working.
• Scan the computers and phones that use those mailboxes with up-to-date security software. Malware on one office PC is a common way mailbox passwords get stolen in the first place.
• Check your website's forms. If a form has a send me a copy option, or sends an auto-reply that repeats what the visitor typed, bots can use it to deliver their message to any address they choose. Turn off copy-to-sender and auto-replies that echo visitor text until you have added bot protection.
• Run your domain and your mail server's IP address through a free blacklist checker such as MXToolbox. Write down which lists you are on; that tells you how widely the damage has spread and which lists to request removal from once the cause is fixed.
• Check that your domain has SPF, DKIM, and DMARC records. They do not stop a hacked mailbox, but they make it much harder for outsiders to spoof your address. See SPF, DKIM and DMARC setup.

What this usually means

There are three common causes, and they need different fixes. The most frequent is a compromised mailbox password: someone has the login for one of your email accounts and is sending spam through your host's mail server as that account. The second is a hacked website, where an attacker has uploaded a mailer script — often hidden inside an out-of-date WordPress plugin or theme — that sends mail directly from the server. The third is an abused form: your contact or registration form works exactly as designed, but bots are using it to deliver their text to strangers through confirmation or copy emails.

There is also a fourth possibility that is not your fault at all: spoofing. Anyone can forge a From address, and the bounces for those forged messages come back to you. If your host confirms nothing unusual left your account, you are probably seeing spoofing, and the fix is proper SPF, DKIM, and DMARC rather than a cleanup. On shared hosting, your server's IP address can also be blacklisted because of another customer on the same server, which your host has to resolve.

Hosts act fast on outgoing spam because it damages the reputation of servers shared by many customers, so hourly sending limits, mail suspensions, and even account suspensions are common. Getting mail flowing again means fixing the actual source first, then asking the host to lift the block and requesting removal from any blacklists. Your legitimate mail may land in spam for a while afterwards, as covered in emails from website going to spam, and big providers like Microsoft can take longer to trust you again — see Outlook and Hotmail blocking your email.

What not to do

• Don't ask to be removed from blacklists before the source is fixed. You will just be listed again, and some lists make repeat removals harder.
• Don't ignore your host's notice or argue with it before asking what they saw. Their logs are the fastest route to the cause.
• Don't change only one mailbox password if you cannot tell which account was used. Change them all.
• Don't assume a website cleanup is done because the spam stopped for a day. A hidden mailer script will often start again.
• Don't move to a new host to escape the problem. A stolen password or hacked script comes with you, and the new host will block you too.
• Don't send your password to anyone who emails claiming to be your host's abuse team. Log in to your hosting account directly to check any notice.

When to get help

It is time for help when your host cannot or will not say which account or script is sending, when the spam comes back after you have changed passwords, when the website itself appears to be the source, or when you are on several blacklists and your normal business email is failing. Every day of blocked mail means lost quotes, invoices, and replies. Someone who does this work can read the mail logs, find and remove a mailer script, close the hole that let it in, and handle delisting in the right order.

Glenn, who runs WebsiteSelfHelp, tracks down and stops spam being sent from small business websites and mailboxes, and gets outgoing email working again. Tell him what your host said and what you have noticed, and he will give you a straight read on the likely cause and what it will take to fix — you do not need to share any passwords to start.

Frequently asked questions

Related free guides