cPanel email security: the complete guide for server administrators

The five layers of email security

No single tool secures email on its own. Each layer covers a different risk, and a gap in any of them ends the same way: outbound spam, the server IP on blocklists, and customers with bounced mail.

A 15-minute checklist

If you run a cPanel server and have never reviewed its email setup, start here. Each item links to the guide that covers it in detail.

1. Hostname and PTR. The server hostname resolves to its IP and the IP has a PTR record with that same name. Details in PTR, A and MX records.
2. Valid SPF, DKIM and DMARC on every domain: check cPanel › Email › Email Deliverability or, for all domains at once, the same tool in WHM. Guide: set up SPF, DKIM and DMARC.
3. cPHulk enabled in WHM › Security Center › cPHulk Brute Force Protection, with your own IP on the allow list.
4. Plaintext authentication disabled in WHM › Service Configuration › Mailserver Configuration (Allow Plaintext Authentication: No).
5. An hourly sending limit set in WHM › Server Configuration › Tweak Settings (Max hourly emails per domain).
6. SpamAssassin enabled and, if you host business customers, a filter that catches targeted phishing.
7. IP off blocklists: check it at check.spamhaus.org. If it's listed, follow this guide.
8. A normal mail queue: exim -bpc should show a few dozen messages, not thousands.

Layer 1: filter inbound email

Inbound filtering decides what reaches the mailboxes. cPanel ships several tools worth enabling before you consider anything else:

• Blocklists (RBLs) in Exim. Under WHM › Service Configuration › Exim Configuration Manager › Basic Editor › ACL Options you can reject connections from IPs listed on Spamhaus ZEN or SpamCop. Note that free use of Spamhaus over public DNS has volume limits; a busy hosting provider needs their Data Query Service (DQS).
• Reject SPF failures. In the same section, this option rejects mail from domains whose SPF record explicitly says the sending server isn't allowed.
• Greylisting. WHM › Email › Greylisting delays the first delivery from unknown senders. It stops a lot of bots, but adds minutes of delay to new legitimate senders.
• SpamAssassin. It scores each message and flags it as spam above a threshold. How to tune it: configure SpamAssassin in cPanel.

These tools are built for bulk spam. Targeted phishing and BEC fraud arrive in a handful of well-written messages from domains with no bad reputation, so they almost always get through. We explain why in why SpamAssassin misses targeted phishing.

Layer 2: protect account access

An attacker who guesses a mailbox password can read that person's mail, create forwarding rules and use the account to send spam from your server. The basic defenses:

• cPHulk blocks IPs and usernames with too many failed logins on cPanel, webmail, IMAP, POP3 and SMTP.
• Mandatory strong passwords in WHM › Security Center › Password Strength Configuration. A value of 70 or higher rules out the most common passwords.
• Encrypted connections only: disable plaintext authentication so nobody sends a password without TLS over ports 110 or 143.
• Two-factor authentication for cPanel and WHM in WHM › Security Center › Two-Factor Authentication. It doesn't cover IMAP or SMTP, but it protects panel access.

Modern attacks try a few passwords against many accounts at once, precisely to avoid lockouts. How to spot them: brute force and password spraying against email.

Layer 3: control outbound sending

No access control is perfect, so the server has to limit the damage when an account falls. In WHM › Server Configuration › Tweak Settings, Mail tab:

Also enable WHM › Security Center › SMTP Restrictions, so only Exim and authorized users can open connections to port 25. That way a malicious script can't bypass the limits by talking straight to other servers.

If you have an active problem right now, follow compromised email account: how to find it and stop the spam.

Layer 4: authenticate your domains

SPF, DKIM and DMARC tell Gmail, Outlook and everyone else which servers may send mail for each domain. Without them, your customers' mail ends up in spam and anyone can spoof their domains. Gmail and Yahoo have required these records from bulk senders since 2024, and Microsoft since 2025.

cPanel's Email Deliverability tool checks and repairs SPF and DKIM in one click when DNS is hosted on the same server. DMARC has to be added by hand. Step by step in set up SPF, DKIM and DMARC in cPanel and, if mail is already landing in spam, in why are my emails going to spam.

Layer 5: monitor

Most email incidents are spotted late, when a customer complains. A few commands and tools surface them in minutes:

# Messages in the queue (normal: a few dozen)
exim -bpc

# Accounts that sent the most mail today (SMTP-authenticated)
grep "A=dovecot_login" /var/log/exim_mainlog | grep -o "A=dovecot_login:[^ ]*" | sort | uniq -c | sort -rn | head

# IPs with the most failed IMAP/POP3 logins
grep "auth failed" /var/log/maillog | grep -o "rip=[0-9a-f.:]*" | sort | uniq -c | sort -rn | head

• WHM › Email › Mail Queue Manager and View Sent Summary show the queue and who is sending the most.
• cPanel › Email › Track Delivery follows a single message and shows why it bounced.
• [Google Postmaster Tools](https://postmaster.google.com) and Microsoft SNDS show how Gmail and Outlook rate your domains and IPs.

Legal duties in the EU and Chile

A compromised mailbox usually exposes personal data: customer emails, documents and passwords. That can trigger legal notification duties. A short overview, not legal advice:

In practice, that means keeping mail logs long enough, having a written procedure for compromised accounts, and being able to show what filtering and controls were in place.

Frequently asked questions