iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The reliable way to stop compromised scripts and accounts from sending mail directly is to enforce the policy in three places: block unauthorized outbound TCP port 25 at the VPS or provider boundary, allow only Exim and explicitly approved service accounts to submit mail locally, and use Exim ACLs with rate limits to reject or slow abusive traffic. Then route legitimate delivery through an authenticated smarthost on port 587 or 465.
A single Exim rule is not enough. A process that can open its own TCP connection can bypass Exim, while a firewall-only rule does not stop a local process from flooding Exim. Layered controls close both paths and leave a clear audit trail.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat the finished design should do
Your VPS should have one approved path for application mail:
- The application submits to the local Exim listener with the credentials and sender policy you approve.
- Exim evaluates SMTP ACLs, authentication, sender and recipient policy, and rate limits.
- Exim hands accepted mail to an authenticated smarthost over port 587 with STARTTLS or port 465 with SMTPS.
- The VPS or hosting provider firewall denies direct outbound TCP/25 except where an explicitly approved relay requires it.
This arrangement prevents ordinary users, web scripts and malware from connecting straight to arbitrary remote mail servers. It also keeps normal website mail working, because applications still submit locally and Exim remains responsible for delivery.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
| Control layer | What it prevents | Where it is enforced |
|---|---|---|
| Provider or VPS egress rule | Direct connections from the server to Internet SMTP servers on TCP/25 | Cloud firewall, security group, provider egress filter or host firewall |
| Local submission restriction | Web users and services bypassing Exim by opening their own SMTP connections | cPanel SMTP Restrictions or operating-system permissions and service design |
| Exim ACL and ratelimit | Authenticated-account abuse, bursts and excessive recipient volume | Exim begin acl rules and the generated configuration |
| Smarthost route | Unapproved direct delivery and unauthenticated relay attempts | Exim routers, transports and authentication settings |
Decide what is allowed before changing Exim
Write down the intended senders, relay destination and volume limits first. A useful policy identifies:
- Which applications may submit mail, such as a web server, queue worker or monitoring service.
- Whether those applications use a local SMTP listener, a Unix socket or a panel-provided submission endpoint.
- Which authenticated identities may send and which envelope-from addresses they may use.
- The smarthost hostname, authentication method and approved submission port.
- What constitutes normal volume for each account, including password-reset bursts, alerts and scheduled jobs.
- Who receives alerts when Exim rejects a message or the smarthost becomes unavailable.
Do not choose a universal rate number simply because it appears in an example. Exim’s specification does not publish one safe limit for every server. A low-volume site and a transactional application have very different baselines. Start from measured normal traffic, leave room for legitimate bursts, and tighten the limit after observing logs.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Block direct outbound SMTP at the VPS boundary
Many VPS providers restrict outbound port 25 by default because unrestricted direct delivery is frequently abused. If your provider offers an egress firewall, security group or SMTP-unblock request, make the policy explicit: deny outbound TCP/25 for the VPS, and allow only the relay path that your mail design actually needs. A smarthost on port 587 or 465 normally does not need a port-25 exception.
Apply the rule in the right place
- Provider control: Use the provider’s network firewall or egress policy when available. This still protects the server if a local process obtains elevated privileges or the host firewall is accidentally disabled.
- Host firewall: Mirror the deny rule locally so the intended policy is visible on the machine and can be tested during deployment. The exact command and persistence method depend on the distribution and firewall framework.
- Approved exception: If your relay operator requires a direct port-25 connection, allow only its documented destination addresses, not all Internet addresses. Record why the exception exists and review it when the relay changes.
Do not confuse inbound SMTP with outbound SMTP. A rule that blocks incoming connections to port 25 does not stop a compromised process from opening an outbound connection. You need an egress rule whose destination is remote TCP/25.
Test the egress policy before touching application settings
From an unapproved service account, attempt a controlled TCP connection to a test remote host on port 25. The expected result is a firewall or provider rejection or timeout, not an SMTP banner. Perform the same test to the smarthost’s approved submission port; that connection must remain reachable. Use a maintenance window and a destination that you are authorized to test.
Because firewall syntax, log locations and persistence differ among distributions and providers, do not paste a Debian, RHEL or panel-specific command into an unrelated system. Confirm the resulting rule in the provider console and on the host, then reboot or reload the firewall in a test environment to ensure it persists.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Use cPanel’s SMTP Restrictions when cPanel manages Exim
On cPanel and WHM systems, the supported control is in WHM → Security Center → SMTP Restrictions. Enable the feature, then save the change. cPanel describes this interface as allowing only “the mail transport agent (MTA), Mailman mailing list software, and the root user” to connect to remote SMTP servers. Ordinary users, websites and scripts therefore cannot bypass Exim by connecting directly to an outside SMTP service.
What applications must change
After the restriction is enabled, a website must submit through the cPanel server rather than contacting a third-party SMTP host directly. Configure the application with the server’s approved SMTP hostname, a real mailbox or submission identity, and its password. Use the submission port and encryption mode required by your Exim and smarthost design. A script that continues to connect directly will fail by design; that failure is evidence that the restriction is working, not an Exim delivery fault.
Add targeted IP controls when necessary
cPanel also provides IP deny lists through WHM → Service Configuration → Exim Configuration Manager → Access Lists. Use these lists for specific abusive or untrusted addresses when a broad policy is not appropriate. Keep an inventory of every entry, its reason and its removal date. An IP deny list is a supplement to SMTP Restrictions, not a replacement for egress filtering.
Constrain local submission on standalone Exim
Standalone Exim installations do not have cPanel’s switch. Establish an equivalent rule through operating-system permissions, service identity and Exim’s listener and ACL configuration.
Separate trusted services from ordinary users
- Run the web application and worker processes under dedicated service accounts rather than a shared login.
- Give only those accounts access to the local submission mechanism they need.
- Require SMTP authentication for network submissions, and keep credentials outside source code and publicly readable configuration files.
- Do not grant a general shell user permission to invoke Exim’s submission interface unless that user is part of the approved mail workflow.
- Where a local process uses Exim’s
-bsinterface, apply the same ACL policy as for network SMTP clients.
Exim ACLs can govern SMTP commands from network clients and from local SMTP submissions using -bs. That makes the ACL layer useful even when the connection never leaves the server. It does not, however, stop a program from opening a raw socket to a remote host; that is why the egress rule remains mandatory.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Build Exim ACLs for abuse control
Exim ACLs are declared under begin acl. The ACL stage you choose determines when Exim rejects the transaction. A MAIL-stage check can stop a message before recipient processing; a RCPT-stage check can account for recipient activity; DATA-stage checks can use message-level information. A non-SMTP submission path may require a different hook in the generated configuration.
Illustrative rate-limit pattern
begin acl
acl_check_mail:
deny ratelimit = 100 / 1h / strict / $authenticated_id
message = submission rate exceeded
acceptThis example denies an authenticated identity after 100 counted events in one hour using Exim’s newer ratelimit ACL condition. It is a starting pattern, not a drop-in configuration. The correct key, ACL hook, authentication variable and generated file location vary between a standalone Exim installation and a panel-managed build. A service that permits unauthenticated local submissions may need a different identifier or an explicit deny rather than a null key.
Why the newer ratelimit condition matters
Exim’s ratelimit condition can measure activity across concurrent and sequential connections. Older smtp_ratelimit_* settings are session-oriented, so they may not stop an attacker that spreads activity across many short-lived sessions. Choose the condition that matches the abuse pattern you are trying to control, and document whether you are counting messages, recipients, connections or another event at the selected ACL stage.
Free tools Windows power users keep installed
One-click scans. No signup required.
Log policy decisions
Return a clear policy message such as submission rate exceeded and make sure the decision is logged. Operators need to distinguish an intentional ACL rejection from a DNS failure, a remote 4xx response or a full queue. Include the authenticated identity or other safe identifier in the log context, but never log SMTP passwords or message content unnecessarily.
Validate before reloading
- Render the configuration produced by your management system, if one is used.
- Run the Exim syntax check appropriate to your installation and fix every error before a reload.
- Inspect the rendered ACL to verify that the rule is attached to the intended hook and that the authentication variable is populated for the clients you expect.
- Reload Exim during a controlled window.
- Submit one permitted message and one message that should be rejected, then inspect the log entries.
Panel-managed files may be regenerated during an update. Keep the source template or panel macro that creates the rule under change control rather than editing a generated file that will later be overwritten.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Route accepted mail through a smarthost
If direct port 25 is blocked, configure Exim to relay accepted messages through an authenticated smarthost. Debian’s reference recommends authenticated submission with STARTTLS on port 587 or SMTPS on port 465 instead of plain SMTP on port 25. The relay provider must support the chosen protocol and credentials.
Specify an alternate port in Debian Exim
In Debian’s Exim configuration, a smarthost can include an alternate port with syntax such as smarthost.example::587. Authentication is configured separately in the appropriate client-authentication section. The double colon is part of the Exim smarthost host-and-port syntax; do not replace it with a URL or append it to an unrelated router option.
Align the router, transport and firewall
- The Exim router must select the smarthost for the messages your applications submit.
- The transport must use the smarthost hostname and the intended submission port.
- The authentication configuration must match the relay’s username, password and TLS requirements.
- The egress policy must permit the smarthost destination on 587 or 465 while denying unapproved port-25 destinations.
- Sender and recipient restrictions must remain in force after routing; a smarthost is not permission to relay arbitrary identities.
When a relay supports both ports, 587 with STARTTLS is the conventional authenticated-submission choice. Port 465 uses SMTPS, in which TLS starts immediately. Do not label a plain port-25 connection as secure merely because it eventually negotiates encryption.
Move applications without creating a bypass
- Inventory every application, cron job, queue worker and monitoring component that sends mail.
- Assign each sender a dedicated service identity and an approved envelope-from pattern.
- Change the application SMTP host to the local Exim endpoint or approved cPanel server.
- Set the authentication username, password, port and TLS mode required by that endpoint.
- Remove old credentials and direct-relay hostnames from environment files, deployment secrets and code repositories.
- Send a controlled test message and verify local acceptance, Exim routing and smarthost handoff in the log.
- Only after successful tests, enable the provider egress block and cPanel SMTP Restrictions in production.
A local submission test proves that Exim accepted a message; it does not prove that the remote relay delivered it. Follow the message through the queue and smarthost response before declaring the migration complete.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verification checklist after each change
- Render and syntax-check the generated Exim configuration before every reload.
- From an unapproved service account, verify that direct outbound TCP/25 is rejected by the provider or host egress policy.
- From an approved application identity, submit a controlled message through the local Exim listener.
- Confirm the Exim log records the accepted submission and the smarthost handoff on the intended port.
- Exercise the rate threshold in a test window and confirm that the ACL returns the configured policy message.
- Inspect queue behavior during a temporary smarthost outage and verify that messages retry rather than bypassing the route.
- Re-test password resets, monitoring alerts, scheduled reports and other legitimate mail after enabling cPanel SMTP Restrictions.
- Check that a reboot, firewall reload and panel configuration rebuild preserve the policy.
Troubleshoot by the point of failure
Direct port 25 still connects
Check the provider egress policy first, then the active host firewall and its default outbound policy. Confirm that you tested from the same network namespace and service account used by the suspected process. An inbound deny rule, an Exim ACL or a cPanel setting cannot block a raw outbound socket by itself.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
The website cannot send after SMTP Restrictions
Confirm that the application now targets the cPanel server, uses a valid mailbox and password, and is not hard-coded to an external SMTP hostname. Check whether the application runs under an unusual service account that the panel does not recognize. Review Exim logs for authentication failure, ACL rejection and queueing separately.
Exim accepts mail but the relay rejects it
Verify the smarthost hostname, alternate-port syntax, TLS mode and authentication file. Check that the envelope sender is permitted by the relay and that the message is not exceeding the relay’s own limits. A successful local submission only means Exim accepted responsibility; the relay can still return a policy or authentication error.
The rate limit blocks legitimate bursts
Determine which ACL stage and key are being counted, then compare the log volume with the application’s normal burst pattern. Increase the threshold only enough to accommodate documented traffic, or use separate identities and limits for materially different workloads. Avoid disabling the ACL globally to solve one noisy account.
Messages remain queued
Inspect whether the smarthost connection is blocked, whether TLS negotiation fails, or whether credentials have expired. Confirm that the route still points to the smarthost and that no fallback router attempts direct port 25. Preserve the queue while diagnosing; deleting queued mail hides the symptom without restoring delivery.
Recommended Free Tools
Operate the restriction safely
- Keep an owner and review date for firewall exceptions, IP deny entries, relay credentials and ACL thresholds.
- Alert on repeated rate-limit rejections, authentication failures and unexpected direct-connection attempts.
- Rotate relay credentials and update every application secret atomically.
- Review Exim and panel updates for changes to generated macros, ACL names and configuration paths.
- Retest after provider migrations, network changes and panel upgrades.
- Document an emergency rollback that restores legitimate alerting without reopening unrestricted direct SMTP.
The strongest design is intentionally redundant: the network layer blocks the bypass, the local-submission layer narrows who can reach Exim, and ACLs limit what an accepted identity can do. Keep those layers aligned with the smarthost route, and a compromised script has no convenient path to turn the VPS into an open outbound mailer.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
