In short
SpamAssassin ships with cPanel. You turn it on under Email › Spam Filters and it scores every message: if it crosses the threshold (5 by default), it gets flagged as spam. For most servers it is best to keep the threshold at 5, move spam to a separate folder instead of deleting it, and only use the allow list for verified senders.
What SpamAssassin is and how it works in cPanel
Apache SpamAssassin is an open-source filter. It checks every email against hundreds of rules (headers, content, DNS block lists and a Bayesian filter that learns from examples) and adds up the points for every rule that matches. If the total crosses the threshold, the message gets flagged as spam.
On a cPanel server this runs inside Exim, the mail server, as each message arrives. Each cPanel account decides what to do with flagged mail, and the administrator can set server-wide options from WHM.
Turning on SpamAssassin for a cPanel account
- Log in to the account's cPanel and open Email › Spam Filters.
- Turn on Process New Emails and Mark as Spam.
- Choose what to do with spam: move it to a separate folder (Spam Box) or delete it automatically above a certain score.
- Save your changes. They apply to mail arriving from that point on.
Depending on the cPanel version, option names may vary slightly, but the section is always under Email.
Which score to use
The threshold sets how many points an email needs to get flagged. A lower number catches more spam, but also flags more legitimate mail.
| Threshold | Effect | When to use it |
|---|---|---|
| 3 | Very strict: catches more spam and flags more legitimate mail. | Accounts that only receive from a handful of known senders. |
| 5 (default) | A balance between spam caught and false positives. | Most accounts. |
| 7 or 8 | Permissive: few false positives and more spam in the inbox. | Accounts that receive a lot of legitimate bulk mail, like newsletters or notifications. |
If you turn on automatic deletion, use a threshold well above the one used for flagging. That way only mail that is spam with high confidence gets deleted, and anything doubtful stays in the folder for review.
A spam folder beats automatic deletion
Moving spam to a folder lets you recover a legitimate email that got flagged by mistake: an invoice, an order confirmation, or a message from a new client. If it gets deleted, the user never knows it arrived.
Encourage your users to check that folder periodically, especially in the first few weeks after turning the filter on.
Allow and block lists
In the additional Spam Filters settings you can add addresses or domains that never get flagged as spam (allow list) or that always do (block list). Wildcards are supported, for example *@provider.cl.
Server-wide options in WHM
Under WHM › Exim Configuration Manager there are SpamAssassin options that apply to the whole server, such as turning it on for every account or rejecting messages above a score during the SMTP conversation.
Rejecting at SMTP avoids storing spam on the server, but the user cannot recover a false positive. Use it only with a very high score and leave the rest to each account's spam folder.
Common mistakes
- Lowering the threshold to 1 or 2 to catch everything. False positives spike and users stop trusting the filter.
- Auto-deleting at the same threshold used for flagging. Legitimate mail gets lost without anyone noticing.
- Allowing whole domains, especially free email providers.
- Not checking SPF, DKIM and DMARC on your own domains. Without them, others can send mail claiming to be you, and your own messages land worse at their destinations. See the BEC fraud guide.
- Expecting SpamAssassin to stop targeted phishing. It was built for bulk spam. We explain why in why SpamAssassin doesn't catch targeted phishing.
Frequently asked questions
Does SpamAssassin come included with cPanel?
Yes. Apache SpamAssassin ships with cPanel at no extra cost, and each account can turn it on under Email › Spam Filters.
What score does cPanel recommend?
The default is 5, which is a good balance for most accounts. Only lower it for accounts that receive from a small number of known senders.
Can it be turned on for every account at once?
Yes. From WHM, under Exim Configuration Manager, you can force SpamAssassin for the whole server and set global options.
Does SpamAssassin detect phishing?
It catches some bulk phishing, especially what is already on reputation lists. Targeted phishing and BEC fraud tend to get through because they don't trigger its generic rules.
When SpamAssassin isn't enough
Clisec filters incoming mail across your whole cPanel server and adds detection for targeted phishing, BEC fraud and malware, without changing MX records.