Control Panels

cPanel Anti-Spam Settings: Stop Spam Coming In and Going Out (WHM Guide)

Spam emails can overload your cPanel server and affect deliverability. By optimizing Exim and Tweak Settings in WHM, you can significantly reduce spam and secure your mail server. Follow this step-by-step guide to configure your server for better email security.

Test before you enable these settings:

Blocklists and sender checks can reject or delay legitimate mail. Make one change at a time, and check that your customers’ email still arrives.

Short answer: In WHM, limit outgoing mail first: set Max hourly emails per domain and the failed-message limit in Tweak Settings, turn on SMTP Restrictions, and add the X-Source headers so you can trace senders. For incoming spam, use the Exim Configuration Manager to enable SpamAssassin, one or two well-known blocklists (RBLs) and SPF checks. Make sure every domain has SPF, DKIM and DMARC records, and watch the mail queue.

Two kinds of spam problem

Problem What it costs you Main tools
Outgoing spam from a hacked account or site Your server IP is blocklisted, and all customers’ mail suffers Sending limits, SMTP Restrictions, tracing headers
Incoming spam to your users Full mailboxes and phishing risk SpamAssassin, blocklists, SPF checks

Outgoing spam does the most damage, so start there.

Limit outgoing mail (Tweak Settings)

In WHM, open Server Configuration > Tweak Settings and go to the Mail tab:

Setting Suggested value Why
Max hourly emails per domain A limit that fits real use, for example 200 to 500 Stops a hacked site sending thousands of messages an hour
Maximum percentage of failed or deferred messages a domain may send per hour For example 25% Spam runs produce many bounces, so this catches them early
Track email origin via X-Source email headers On Adds headers showing which script or user sent a message
Prevent “nobody” from sending mail On, if your sites send mail through PHP as their own user Blocks mail from processes that run as the nobody user

You can also set a sending limit for each hosting package in Packages > Edit a Package, and for single accounts.

Turn on SMTP Restrictions

Open Security Center > SMTP Restrictions and enable it. Only Exim, root and the mail system can then connect to remote mail servers. Scripts on hacked websites can no longer bypass Exim, so every message is logged and counted against the limits above. If you use CSF, it has an equivalent option, SMTP_BLOCK; use one of the two.

Filter incoming spam (Exim Configuration Manager)

Open Service Configuration > Exim Configuration Manager > Basic Editor:

  • Apache SpamAssassin: turn it on, so messages get a spam score. Users can then set their own threshold and auto-delete level in cPanel under Email > Spam Filters.
  • RBLs: enable one or two well-known blocklists, such as Spamhaus ZEN or SpamCop. Read each list’s usage terms; some require registration for commercial or high-volume use.
  • Reject SPF failures: rejects mail that the sender’s own SPF record says is forged. Test it, because some legitimate senders have broken SPF records.
  • Sender verification callouts: checks that the sender address exists. It can slow delivery and cause false rejections, so use it with care.

Add servers you trust, such as a partner’s mail server, to the RBL whitelist so they are never blocked.

Authenticate your own domains

SPF, DKIM and DMARC records tell other servers which mail from your domains is genuine. That improves delivery and makes it harder for spammers to forge your domains. In WHM, Email > Email Deliverability shows domains with missing or wrong records and can repair them. See our guide to the Email Deliverability interface.

Watch for problems

  • ✓ Check the queue size each day with exim -bpc. A sudden jump means something is sending spam.
  • ✓ Read the lfd or cPHulk alerts about failed email logins. They often come before a hacked account starts sending.
  • ✓ Check your server IP against blocklists from time to time.
  • ✓ If spam does go out, trace it with our guide to finding the source of spam.

Protect email accounts

  • Require strong passwords in WHM (Security Center > Password Strength Configuration).
  • Turn on cPHulk brute force protection, so repeated failed logins are blocked.
  • Ask users to change passwords that may have leaked, and to use an app password or two-factor login where their mail client supports it.

Check the results

  1. Send test messages from an account to an external address, and check that they arrive.
  2. Send a message to a test mailbox on the server from an outside service, and check its spam score in the headers.
  3. Check /var/log/exim_mainlog for legitimate messages that were rejected after your changes.

Need help with this?

Want your mail server tuned and watched? Our server management team sets sensible limits and handles blocklist problems.

See server management plansContact @CustomerPanel

Frequently asked questions

How do I limit how many emails a cPanel account can send?

Set Max hourly emails per domain in WHM Tweak Settings, or a per-package limit in Edit a Package.

What does SMTP Restrictions do?

It stops scripts from connecting to remote mail servers directly, so all mail goes through Exim, where it is logged and limited.

Which blocklists should I use?

One or two well-known lists, such as Spamhaus ZEN or SpamCop. Check their terms of use, and test for false rejections.

Will SpamAssassin delete mail automatically?

Only if a user turns on auto-delete. By default it adds a score and marks spam in the subject or headers.

Why do my emails still go to spam at Gmail?

Usually because SPF, DKIM or DMARC records are missing or wrong. Check Email Deliverability in WHM.


Sources