Spool Overview
The email spool is a list of messages, in the order they were created, that are waiting for the server to either deliver locally or send out to other mail servers. The Spool Overview page is a real-time dashboard that summarizes the current health and activity of that spool — overall message volume, the busiest senders and IP addresses sending outbound mail, and the busiest senders, IP addresses, and domains sending inbound mail. In addition to reviewing spool activity, administrators can act directly on the messages currently sitting in the spool — for example, an IP address that suddenly floods the server with outbound mail can be blacklisted from this very page, stopping the problem before it spreads to other domains and users on the server.
Monitoring the spool regularly is good practice, but the Spool Overview page is especially useful when a mailbox or the server itself has been compromised: a spike in outbound volume from a single user or IP is often the first visible sign of a compromised account or an open relay being abused, and this page lets an administrator spot it, block the source, and clean up the offending messages, all from one screen. The Top Senders, Top IP Addresses, and Top Domains tables refresh automatically every 20 seconds; the Message Activity table at the top of the page refreshes on a slower cycle, roughly every two and a half minutes.
Spool Processing
By default, SmarterMail runs its spool processing loop on a three (3) second cycle, checking each queue a message might be waiting in and moving it to the next stage if it's ready. A typical message passes through several stages in order: an initial write/delay stage, antivirus scanning, spam checking, and finally either local delivery, remote delivery, or being routed to quarantine (spam or virus) or marked as failed. Messages move between these queues at effectively random times relative to one another — the three-second figure describes how often each queue is re-checked, not a guaranteed processing time for any individual message. If a message is ready for its next step when its queue is checked (e.g., it passed spam checks) it immediately advances to the next queue (e.g., local delivery); if it isn't ready yet, it simply waits for that queue's next three-second check. Because of this, delays noted in the mail logs for otherwise similar messages can vary noticeably from one message to the next.
Moving Spooled Messages
Several of the tables below include a Move Messages action, which relocates the matching .eml files out of the active spool and into a separate folder for review, without deleting them. Unless a different path is entered, SmarterMail defaults this destination to a MovedSpoolItems subfolder directly under the server's configured spool path (for example, C:\SmarterMail\Spool\MovedSpoolItems\ on Windows, or the equivalent under a Linux install's configured spool path). Because Move Messages (like Delete Messages) only ever acts on messages that are currently sitting in the spool at the moment the action is triggered, it has no effect on mail that has already been delivered to a mailbox or that lives in an archive store.
Message Activity
This table displays the total number of messages that have been sent by, or delivered to, all users on the server, including both local (user-to-user) and remote deliveries. Unlike the tables further down the page, it reports four time windows: the last 5 minutes, the last hour, the last 24 hours, and the total since the server was last started (or restarted). That last column is particularly useful after a restart or upgrade, since it gives an immediate read on overall traffic without needing to wait for an hour or a day to accumulate.
Top Outbound Senders
This table lists the local user accounts with the highest number of outbound, remote deliveries over the last 5 minutes, 1 hour, and 24 hours. A "remote delivery" is any message being sent to a recipient outside of the domains hosted on this server (i.e., it will actually leave the server over SMTP), so this table is one of the fastest ways to spot an account that has been compromised and is being used to send spam.
The following actions can be performed on each user listed in the table:
- Manage User – Logs in and impersonates the account so the administrator can review its settings exactly as the user sees them (and its Domain Settings too, if the account is a domain administrator). This is normally the first step when investigating a user that appears to be sending spam, since it lets the administrator check things like the account's saved credentials, filters, and connected devices before deciding whether to disable it.
- Change Password – Immediately changes the password on the account. This is the standard remediation step once a compromised account has been confirmed, since it invalidates any credentials an attacker may have obtained (e.g., via a phished webmail login or a leaked IMAP/SMTP password used by a script).
- Drop Connections – Forcibly ends all of the user's active connections across every protocol — webmail, SMTP, IMAP, POP, XMPP, EAS, and MAPI/EWS. This is useful for immediately cutting off a device or script that is actively mid-send when the account is discovered, rather than waiting for a changed password to take effect on its own.
- Disable User – Immediately disables the user. This action sets the same User Status field found when editing a user, specifically to ‘Disable and Allow Mail'. This stops the user from sending outbound messages or logging into webmail/other clients, while still allowing the mailbox to receive incoming mail — so legitimate senders don't get bounce messages while the investigation is underway. Because this is the same underlying setting, re-enabling the user from either the Spool Overview page or the user's own settings page updates the other automatically.
- Delete Messages – Permanently deletes the messages sent by this user that are currently sitting in the spool.
- Move Messages – Moves this user's currently-spooled messages to another folder, as described in Moving Spooled Messages above.
Top Outbound IP Addresses
This table lists the IP addresses that have sent the highest number of outbound, remote deliveries over the last 5 minutes, 1 hour, and 24 hours. It's a useful companion to Top Outbound Senders: a single compromised account will usually show up as one entry in both tables, but a genuinely compromised server, an open relay, or a script sending under many forged local addresses may show up more clearly here first. The following actions can be performed on each IP address listed in the table:
- Blacklist – Blocks the IP address from sending any further messages to the server. This adds an entry to the same underlying list used by Security > Blacklist, with only the SMTP protocol flag enabled on that entry (so the block applies to inbound SMTP connections from that IP, not other protocols like IMAP or POP). The entry is tagged as having originated from the spool. Removing the block from either the Spool Overview page or the Security > Blacklist page removes the same underlying entry, so the two stay in sync automatically.
- Delete Messages – Permanently deletes all outbound messages sent from this IP address that are currently in the spool.
- Move Messages – Moves all outbound messages sent from this IP address that are currently held in the spool to another folder, as described in Moving Spooled Messages above.
Top Inbound Recipients
This table lists the local user accounts (recipients) that have received the highest number of incoming messages over the last 5 minutes, 1 hour, and 24 hours, counting both local (user-to-user) and remote deliveries. It's a quick way to see which mailboxes are receiving the heaviest mail load — useful both for spotting a mailing list or shared account under unusually heavy load, and for identifying a user who may be the target of a spam or phishing campaign. The following actions can be performed on each user listed in the table:
- Manage User – Logs in and impersonates the account so the administrator can review its settings and, if the account is a domain administrator, its Domain Settings as well.
- Change Password – Changes the password on the account, which is the standard step when resolving a compromised account.
- Drop Connections – Ends the user's active connections across webmail and the various syncing protocols, including SMTP, IMAP, POP, XMPP, EAS, and MAPI/EWS.
- Delete Messages – Permanently deletes all inbound messages addressed to this user that are currently in the spool.
- Move Messages – Moves this user's currently-spooled inbound messages to another folder, as described in Moving Spooled Messages above.
Top Inbound Senders
This table lists the sender email addresses that have sent the highest number of messages to users on this server over the last 5 minutes, 1 hour, and 24 hours. The following actions can be performed on each address listed in the table:
- Block Inbound SMTP – Blocks all future incoming mail from this exact email address. This writes to the same underlying rule set used by Security > SMTP Blocks, adding an entry tagged as having originated from the spool. Removing the block from either the Spool Overview page or the Security > SMTP Blocks page removes the same entry, so the two stay in sync automatically.
- Delete Messages – Permanently deletes all inbound messages sent from this address that are currently in the spool.
- Move Messages – Moves all inbound messages sent from this address that are currently held in the spool to another folder, as described in Moving Spooled Messages above.
Top Inbound IP Addresses
This table lists the IP addresses that have sent the highest number of messages to users on this server over the last 5 minutes, 1 hour, and 24 hours. The following actions can be performed on each IP address listed in the table:
- Blacklist IP – Blocks the IP address from sending any further messages to the server. As with the Top Outbound IP Addresses table, this adds an entry to the same list used by Security > Blacklist, with only the SMTP flag enabled, tagged as originating from the spool. Removing the block from either location removes the same entry.
- Delete Messages – Permanently deletes all inbound messages sent from this IP address that are currently in the spool.
- Move Messages – Moves all inbound messages sent from this IP address that are currently held in the spool to another folder, as described in Moving Spooled Messages above.
Top Inbound Domains
This table lists the sender domains that have sent the highest number of messages to users on this server over the last 5 minutes, 1 hour, and 24 hours. The following actions can be performed on each domain listed in the table:
- Block Inbound SMTP – Blocks all incoming mail from the domain. This writes to the same
underlying rule set used by Security > SMTP Blocks,
tagged as originating from the spool.
Note: This does not create an EHLO-domain rule. Instead, it creates an Email Address rule containing only the bare domain (with no @ symbol) — a different match type than blocking by EHLO/HELO name, since it's matched against the sender's address rather than the domain name the connecting server announces during the SMTP handshake.Removing the block from either the Spool Overview page or the Security > SMTP Blocks page removes the same entry, so the two stay in sync.
- Delete Messages – Permanently deletes all inbound messages sent from the domain that are currently in the spool.
- Move Messages – Moves all inbound messages sent from the domain that are currently held in the spool to another folder, as described in Moving Spooled Messages above.