In short
A cPanel antispam works in four layers: the SMTP connection (RBLs and greylisting), authentication (SPF, DKIM and DMARC), content (SpamAssassin) and targeted threats (phishing, BEC fraud, links and attachments). cPanel gives you the first three for free. What is missing, and what you should compare when choosing a product, is the fourth layer, plus the cost of changing MX records, the pricing model and a quarantine to recover false positives.
The four layers of a cPanel antispam
People searching for "the best antispam for cPanel" usually compare whole products. Comparing layers is more useful, because each one stops a different kind of mail and most servers already have some of them running without knowing it.
| Layer | What it stops | Built-in cPanel tool |
|---|---|---|
| SMTP connection | Botnets and servers with a bad reputation, before the message is received | Exim RBLs and ACL options, greylisting |
| Authentication | Mail that spoofs the exact domain of a DMARC-protected sender | Exim SPF, DKIM and DMARC checks |
| Content | Bulk spam: offers, generic scams, unwanted newsletters | SpamAssassin (Spam Filters) |
| Targeted threats | Credential phishing, BEC fraud, links to fake pages, malware attachments | Nothing specific (ClamAV only covers known viruses) |
The first three layers take minutes to set up and stop most of the volume. The fourth decides whether a customer loses money or a password, and it is what really separates one product from another.
What cPanel includes for free (and you should enable first)
Before comparing products, make sure the server has the basics. These are WHM settings that cost nothing, and every paid antispam assumes they are already in place:
- RBLs in Exim (Spamhaus ZEN and SpamCop) to reject IPs known for sending spam. Step by step in Exim antispam settings in WHM.
- Greylisting, which delays the first delivery from unknown senders. When it helps and how to avoid delays: greylisting in cPanel.
- SpamAssassin with a threshold of 5 and a spam folder on every account: how to configure SpamAssassin in cPanel.
- The dangerous attachments filter in WHM › Exim Configuration Manager › Filters, which blocks executables such as .exe or .scr.
- Email filters for one-off cases, like a sender who keeps writing: cPanel email filters.
With these five measures, a typical server stops receiving most bulk spam. What still gets through are messages from few senders, well written and sent from domains or accounts with no bad reputation. That is where the most damaging attacks are, as we explain in why SpamAssassin misses targeted phishing.
Types of antispam for a cPanel server
Beyond the built-in tools, the options fall into three groups. The main difference is where mail is filtered and what you have to change to turn it on.
- Plugins installed on the server. They filter inside Exim, during the SMTP conversation. They don't change MX records or the path mail takes, and they are usually priced per server. MagicSpam and Clisec are in this group, among others.
- Cloud filtering gateways. Mail goes through the provider's servers first and then reaches yours. Some offer a cPanel add-on that automates the MX change, such as SpamExperts (now part of N-able Mail Assure). They are usually priced per domain or per mailbox.
- Outbound relays. Services such as MailChannels are best known for filtering and delivering the mail your server sends. They improve delivery and protect your IP, but they don't replace a filter for the mail you receive.
Products change their features and prices often. What we describe here is the general model of each group; before deciding, check each provider's current documentation.
Comparison: what changes between the options
| Criterion | cPanel tools only | Plugin on the server | Cloud gateway |
|---|---|---|---|
| Where mail is filtered | In Exim, on your server | In Exim, on your server | On the provider's infrastructure |
| MX record changes | No | No | Yes, on every domain |
| Bulk spam | Good with well-tuned RBLs and SpamAssassin | Good to very good | Good to very good |
| Targeted phishing and BEC | Weak | Depends on the product: ask what it checks beyond reputation | Depends on the product and plan |
| Quarantine and release | Only each account's spam folder | Common | Common |
| Pricing model | Included in the cPanel license | Usually per server | Usually per domain or mailbox |
| Where mail travels | It never leaves your server | Depends on whether analysis is local or calls an external service | Through the provider's servers |
Changing MX records sounds like a detail, but on a host with hundreds of domains it is a project: you have to edit DNS zones that customers sometimes manage themselves, plan for propagation and change them back if you ever leave the service. A filter inside the server is turned on once and covers every domain, including the ones added later.
Which option fits your case
| Your case | Priority | Option that usually fits |
|---|---|---|
| Shared hosting with hundreds of domains | Cover everything without touching customer DNS, at a predictable cost | A server plugin priced per server |
| Agency managing its customers' email | Few false-positive complaints, and each customer releasing their own messages | A plugin with quarantine and per-user self-service |
| Company running its own cPanel server | Stopping phishing and BEC fraud aimed at its staff | cPanel tools plus an anti-phishing layer |
| Personal or test server | Zero cost | Well-configured RBLs, greylisting and SpamAssassin |
If your customers are in Europe or Chile, add one more question: where is the mail processed? Under the GDPR in Europe and Law 21.719 in Chile, a service that reads third-party email is a data processor and needs a contract that governs it.
Ten questions to ask any provider
A two-week trial on a real server tells you more than any sales sheet. During the trial, or before you sign up, ask for concrete answers to these:
- What does it check beyond IP and domain reputation? Does it follow links? Does it inspect attachments?
- How does it detect a BEC email that has no links or attachments?
- What happens to a blocked message: is it rejected, discarded or quarantined?
- Can end users release their own false positives, or does everything go through the administrator?
- Is there a per-message log with the reason for each decision?
- Do I need to change MX records or configure anything on each account?
- How is it priced: per server, per domain or per mailbox? What happens to the price as the server grows?
- What does the filter do if its service stops responding: deliver unfiltered or hold mail?
- Where is mail processed, and is there a data processing agreement?
- In which languages and during which hours is support available?
Common mistakes when setting up antispam
- Deleting spam automatically. A deleted false positive can't be recovered. Always use a spam folder or a quarantine.
- Stacking filters that contradict each other. A plugin rejecting at SMTP, plus very aggressive SpamAssassin rules, plus account filters ends in lost mail nobody can explain. Decide which layer decides what.
- Using allow lists to "fix" false positives. Allowing a whole domain also lets in anyone who spoofs it. Allow specific addresses and find out why the message was blocked.
- Querying Spamhaus through public DNS. If the server uses 8.8.8.8 or 1.1.1.1 as its resolver, Spamhaus lookups fail. Use a local resolver.
- Measuring volume only. A filter that blocks 99% of spam but lets one BEC email through each month is still a problem. Also measure the dangerous messages that got in.
Frequently asked questions
What is the best antispam for cPanel?
It depends on what you are missing. If the problem is spam volume, well-configured RBLs, greylisting and SpamAssassin are often enough. If the problem is phishing and BEC fraud, you need a layer that analyzes links, attachments and impersonation, and it is worth testing it on your own server.
Is SpamAssassin still a good antispam in 2026?
Yes for bulk spam, especially combined with RBLs and greylisting. It isn't designed for targeted email, which arrives in low volume and without the signals its rules look for.
Is a server-side antispam better than a cloud one?
Both can filter well. In practice, a cloud gateway requires changing every domain's MX record and is usually priced per mailbox, while a plugin is turned on once for the whole server and is usually priced per server.
Do I need an antispam if I use MailChannels?
Yes. MailChannels is best known for filtering and delivering mail leaving your server. The mail your accounts receive needs its own filter.
How much does a cPanel antispam cost?
cPanel's tools are included. Plugins usually charge a monthly fee per server and cloud gateways charge per domain or mailbox. Clisec starts at CLP 15,000 per server per month, VAT included; current prices are on the pricing page.
Antispam and antiphishing for your whole cPanel server
Clisec installs on your cPanel server and adds targeted phishing, BEC fraud and malware detection to what cPanel already filters, with no MX changes and a flat rate per server.