cPanel email filters: account-level and global rules against spam and phishing

Which filters cPanel has

If you want to tune the SpamAssassin score or the spam folder, that is covered in how to configure SpamAssassin in cPanel. This guide covers condition-based rules.

How to create a filter step by step

1. Go to cPanel › Email › Global Email Filters (or Email Filters, and pick the account).
2. Click Create a New Filter and give it a name that explains why it exists, for example "Block fake invoices".
3. Under Rules, choose the part of the message (From, Subject, To, Any Header, Body, Spam Status, Spam Score…), the operator (contains, matches regex, begins with…) and the value.
4. Under Actions, choose what to do: Deliver to Folder, Redirect to Email, Fail with Message, Discard Message or Stop Processing Rules.
5. Save and test it with the Filter Test tool on the same page, pasting the headers of a real message.

Seven useful rules against spam and phishing

The last two rules target specific attacks: fake cPanel and Webmail emails asking for the password with a "mailbox full" excuse, and BEC fraud, which diverts replies to the attacker's free account. Check the folder for the first few weeks: real suppliers and customers use Gmail too.

In a rule with several conditions, cPanel lets you choose between "and" and "or". For the manager impersonation rule you need "and": the name appears and the domain isn't yours.

What filters can't do

cPanel filters are useful for one-off cases, but they have clear limits:

• They don't inspect attachments. The "Body" condition only sees the start of the message, so it can't detect a dangerous file. That is what Exim's attachment filter is for.
• They don't follow links. A rule can't tell whether a link leads to a fake login page.
• They don't verify the sender. "From contains @bank.com" also matches an email spoofing the bank. Use SPF, DKIM and DMARC for that.
• They don't scale. Every new attack needs another rule, and old rules stay there catching false positives years later.
• Attackers use them too. Whoever steals a password often creates a filter that forwards or hides messages. Check an account's filters if you suspect it was compromised.

The Exim system filter (for administrators)

As the server administrator you can apply a rule to all mail without going into each account. Exim uses a system filter file, /etc/cpanel_exim_system_filter by default. Don't edit that file: cPanel replaces it on updates. Copy the original, add your rules at the end and point the System Filter File option in the Filters tab to the copy.

# Example: tag the subject of outside mail that uses your manager's name
if $header_from: contains "First Last"
   and $header_from: does not contain "@yourcompany.com"
then
  headers add "X-Warning: external sender using an internal name"
  headers remove "Subject"
  headers add "Subject: [EXTERNAL] $h_subject:"
endif

Test the filter before enabling it with exim -bF filter-file < message.eml, which shows what it would do without delivering anything. A syntax error in the system filter can stop delivery for the whole server.

When filters are no longer enough

If you add rules for a different attack every week, the problem is no longer about rules. Bulk spam is better stopped by RBLs and greylisting (Exim antispam settings in WHM), and targeted phishing needs a filter that analyzes links, attachments and impersonation in every message. We compare the options in cPanel antispam.

Frequently asked questions