Exim is the mail server (MTA) on every cPanel & WHM server. Its defaults are reasonable, but a few settings make a big difference to spam filtering, security and deliverability. All of them are in WHM's Exim Configuration Manager, so you rarely need to edit configuration files by hand.
Before you start
- Root access to WHM.
- Change one area at a time and test sending and receiving afterwards. WHM validates the configuration before saving and refuses broken settings.
- Open WHM → Service Configuration → Exim Configuration Manager and stay on the Basic Editor tab.
RBLs (blocklists)
On the RBLs tab, enable RBL: spamcop.net and RBL: spamhaus.org. Mail from IPs on those lists is rejected at connection time, before it uses resources. Tick Exempt servers in the same IP block as this server from RBL checks and add trusted relays to Trusted SMTP IP addresses if needed.
Note: Spamhaus blocks queries from large public DNS resolvers. Make sure the server uses its own or the data centre's resolvers in /etc/resolv.conf, otherwise RBL lookups fail silently.
Apache SpamAssassin options
| Setting | Suggested value |
|---|---|
| Apache SpamAssassin global subject rewrite | On (adds ***SPAM*** to subjects) or let users decide |
| Scan outgoing messages for spam and reject based on threshold | On, threshold around 10 |
| Do not forward mail to external recipients if it matches the SpamAssassin spam threshold | On (protects forwarder reputation) |
| Apache SpamAssassin: Forced Global ON | On, so every account is scanned |
| Apache SpamAssassin reject spam score threshold | e.g. 10 (rejects obvious spam at SMTP time) |
Users still fine-tune their own threshold in cPanel Spam Filters.
ACL options
- Require HELO before MAIL and Reject SPF failures: On (the second only if you are comfortable rejecting misconfigured senders).
- Sender verification callouts: usually Off, as they slow delivery and some providers dislike them.
- Ratelimit suspicious SMTP servers and Dictionary attack protection: On.
- Maximum message recipients: set a sane cap, e.g.
100, to slow down abuse.
Security and TLS
- On the Security tab, keep Allow weak SSL/TLS ciphers Off and require TLS for authentication.
- Install a valid certificate for the hostname so clients do not see warnings; see service SSL certificates.
- Enable DKIM signing and Reference /etc/mailhelo / /etc/mailips only if you send from multiple IPs and know why.
Relaying through a smarthost
If your server's IP has poor reputation or port 25 is blocked by the provider, route outgoing mail through a relay service. In the Mail tab, set Smarthost support to the relay's host and port (e.g. relay.example.net::587), and add authentication in the Advanced Editor under the AUTH and router sections as the relay provider documents.
Apply and test
- Click Save. WHM tests and restarts Exim.
- Send mail from a cPanel mailbox to an external address and back.
- Check WHM → Email → Mail Delivery Reports for rejections caused by your changes.