Configure SpamAssassin and Spam Filters in cPanel

cPanel uses Apache SpamAssassin to score every incoming message. Each test a message fails adds points, and once the total passes your threshold, the message is treated as spam. The Spam Filters page in cPanel controls what happens next. This guide shows how to enable it, pick a sensible threshold, and handle senders who are wrongly blocked or wrongly allowed.

Before you start

• A cPanel login for the account.
• SpamAssassin enabled on the server. In WHM, check that the Apache SpamAssassin service is running in Service Configuration » Service Manager, and that the Spam Filters feature is allowed in the account's feature list.
• A few real spam and real good messages to compare scores later.

Turn on spam scoring

1. In cPanel, open Email » Spam Filters.
2. Switch on Process New Emails and Mark them as Spam.

From now on, SpamAssassin scores incoming mail and adds headers such as X-Spam-Status and X-Spam-Score. Messages over the threshold also get ***SPAM*** added to the subject by default. Nothing is moved or deleted yet.

Move spam to a Spam Box

Switch on Move New Spam to a Separate Folder (Spam Box). Spam then goes into a spam folder in each mailbox instead of the inbox. Users can review it in Webmail or any IMAP app.

Use Configure Spam Box Settings to empty the spam folder for one account or all accounts when it grows large.

This is the recommended setting for most domains: users rarely see spam, but nothing is lost if a good message is misjudged.

Auto-delete only for obvious spam

Automatically Delete New Spam (Auto-Delete) deletes messages above a score you choose. Set this threshold higher than the marking threshold, so only very obvious spam is deleted. A score around 10 is a common, cautious choice.

Choose the spam threshold score

Open Additional Configurations (For Advanced Users) and click Configure Apache SpamAssassin™ Options (the label may differ slightly between versions), or look for Spam Threshold Score.

• 5 is the standard SpamAssassin default and a good starting point.
• Lower numbers (3 or 4) catch more spam but also more good mail.
• Higher numbers (6 or 7) let more spam through but rarely misfile real mail.

Change it in small steps and watch the result for a week. The Calculated Spam Score Settings list shows the effect of each option.

To see why a message was scored as it was, open it in Webmail and view the full headers. The X-Spam-Status line lists the score and the tests that fired, such as BAYES_99 or URIBL_BLOCK.

Whitelist and blacklist senders

Also under Additional Configurations:

• Whitelist (Emails Always Allowed): add addresses or domains that must never be marked as spam, for example invoices@supplier.example or *@partner.example.
• Blacklist (Emails Never Allowed): add senders that should always be treated as spam.

Use wildcards with care. Whitelisting a whole free-mail domain like *@gmail.com lets spammers through.

Check it works

Send the standard GTUBE test string, which SpamAssassin always scores as spam, from an outside account to a test mailbox. Put this exact line in the message body:

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

The message should be marked and land in the Spam Box. From SSH, you can also check that the service runs:

systemctl status spamd --no-pager

On some servers the unit is named spamassassin; use whichever exists.

Troubleshooting

• Spam Filters page missing: the feature is disabled in the account's feature list. Enable it in WHM » Packages » Feature Manager.
• Nothing is scored: SpamAssassin is not running. Start it from WHM » Restart Services and check Service Manager.
• Good mail lands in the Spam Box: the threshold is too low or the sender's domain lacks SPF and DKIM. Raise the threshold slightly or whitelist the sender.
• Spam still reaches inboxes: the score is just under the threshold. Lower it by one point, and consider server-wide RBLs in Exim Configuration Manager.

Next steps

• Make your own mail trusted: SPF, DKIM and DMARC in cPanel.
• Investigate missing mail: track email delivery.