What a smart host is

A smart host is another mail server that accepts your outgoing mail and delivers it for you. Instead of connecting to each recipient’s mail server, Exim hands every outgoing message to the smart host. Common reasons to use one:

• Delivery: a relay service with a good reputation, such as an email delivery provider or Google Workspace’s SMTP relay.
• Outgoing filtering: a filtering service scans outgoing mail for spam before it leaves.
• Blocked port 25: some networks block direct outgoing connections on port 25.
• One sending address: all servers send from a central relay, which is easier to manage.

Incoming mail is not affected. Your MX records and mailboxes stay the same.

Before you start

• ✓ The relay’s host name and port (usually 587 with TLS, or 25 for IP-authorised relays).
• ✓ How the relay authenticates you: by your server IP address, or with a user name and password.
• ✓ The relay’s SPF value, to add to your domains’ SPF records.
• ✓ A backup of the current Exim configuration. Exim Configuration Manager can make one for you.

Step 1: set the smart host in the Basic Editor

1. In WHM, open Service Configuration > Exim Configuration Manager.
2. Open the Basic Editor and the Mail tab.
3. Find Smarthost support and enter the route list (see below).
4. If the relay needs a login, turn on Smarthost requires SMTP authentication and follow the prompts.
5. Click Save. WHM rebuilds the Exim configuration and restarts Exim.

A route list has a domain pattern, then the relay host. The * means all remote domains. A port can be added after two colons:

# All outgoing mail through one relay on port 587
* smtp.relay.example.com::587

# Two relays, tried in order
* "smtp1.relay.example.com::587 : smtp2.relay.example.com::587"

Check your relay’s documentation for the exact host and port.

Step 2: authentication

Relays that authorise your server by IP address need no password: ask the relay to allow your server’s IP. Relays that need a login use the authentication setting above, with the credentials added as cPanel’s documentation describes for your version. If several domains on the server need different logins, cPanel documents a way to add per-domain authenticators in the Advanced Editor.

Do not edit /etc/exim.conf directly. cPanel rebuilds it, so changes there are lost. Older guides that add routers to /etc/exim.conf.local by hand should be replaced with the Basic Editor settings, which cPanel added for this purpose.

Step 3: update SPF

Mail now leaves through the relay, so each domain’s SPF record must allow it. Add the relay’s include, keeping a single SPF record per domain, for example:

v=spf1 +a +mx +ip4:203.0.113.10 include:spf.relay.example.com ~all

WHM’s Email Deliverability page shows any domains whose records need fixing. See our Email Deliverability guide.

Step 4: test and check the logs

# Send a test from the server
echo "smarthost test" | mail -s "Smarthost test" you@example.org

# Watch the delivery
tail -f /var/log/exim_mainlog

A successful delivery shows T= with the smart host transport and H=smtp.relay.example.com. Open the received message and check the headers: SPF and DKIM should pass.

Keep DKIM signing

cPanel signs outgoing mail with each domain’s DKIM key. The Basic Editor smarthost option keeps cPanel’s normal signing. If you build a custom router or transport in the Advanced Editor instead, check that messages still carry a valid DKIM signature, because a custom transport may not sign them.

Troubleshooting