A client of mine has a linux/cpanel based web server (VPS), which at some point in the past was also the primary mail server for the domain. It is no longer receiving mail (MX records were changed to point to hosted google mail), however I still need to be able to send email from local processes without relying on smart host, therefore exim is still running.
I removed POP3/imap and changed exim config to only listen on localhost interface (127.0.0.1). I checked connections to port 25, 465 and 587 from external hosts - I get 'connection refused' - which is what I want.
Yet, occasionally, in the exim log I see emails that have been received from external hosts for relaying. It's a small number, double-digits per day, but I shouldn't be seeing any at all!
So, the question is what else should I look for on the host? Any other ports I should check or any other apps or config params? I am only on a basic level familiar with cpanel - I've always dealt with things in a terminal window - but either solution is fine.
I have full root access to the box.
EDIT: Here's an example entry from exim_mainlog:
2016-05-15 03:52:25 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1b1qqf-0001Oe-ES
2016-05-15 03:52:27 1b1qqf-0001Oe-ES => *******@worldcorkgc.pt R=dkim_lookuphost T=dkim_remote_smtp H=worldcorkgc.pt [109.71.43.50] X=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no C="250 OK id=1b1qqh-0019IV-29"
2016-05-15 03:52:27 1b1qqf-0001Oe-ES Completed
I also see the same relaying records in cpanel email delivery report.