In short
The best place to stop spam on cPanel is Exim, before it accepts the message. In WHM › Service Configuration › Exim Configuration Manager › Basic Editor you should enable the Spamhaus and SpamCop RBLs, SPF failure rejection, dictionary attack protection, the dangerous attachments filter and DKIM verification. Every SMTP rejection tells a legitimate sender right away that delivery failed, and saves SpamAssassin from analyzing that message.
Why filter in Exim and not just with SpamAssassin
Exim is cPanel's mail server. During the SMTP conversation, before receiving the full message, it already knows the sender's IP, the name used in the greeting (HELO), the envelope address and the recipients. That is enough to reject a large share of spam without reading a single line of content.
| Exim rejection (SMTP) | SpamAssassin mark | |
|---|---|---|
| When | Before the message is accepted | After it has been fully received |
| Server cost | Very low | High: it analyzes the whole content |
| If it's a false positive | The sender gets a bounce and knows it wasn't delivered | The message sits in the spam folder and nobody sees it |
| Where the spam ends up | It takes no space in any mailbox | It takes space in the spam folder |
Option names and locations can vary slightly between cPanel versions. If you can't find one, use the search box at the top of the Basic Editor.
RBLs: rejecting IPs with a bad reputation
An RBL (DNS-based blocklist) is a database of IPs that send spam. Exim looks up the IP of each connection and rejects it if it is listed. In the Basic Editor, RBLs tab (in older versions, inside ACL Options):
| Option | Recommended value | Comment |
|---|---|---|
| RBL: zen.spamhaus.org | On | The most widely used list. It combines SBL, XBL and PBL. |
| RBL: bl.spamcop.net | On | Based on user reports; complements Spamhaus. |
| Exempt servers in the same IPv4 class C / IPv6 /64 from RBL checks | On | Avoids blocking your own neighboring servers. |
| Exempt IP addresses in the Greylisting "Trusted Hosts" list | On | Respects the exceptions you already defined. |
| Manage Custom RBLs | Optional | To add other lists, such as Spamhaus DQS. |
To check that the RBL answers, look up the test address Spamhaus always keeps listed:
# Should return 127.0.0.2 and other 127.0.0.x codes
dig +short 2.0.0.127.zen.spamhaus.org
# If it returns 127.255.255.x, the query is being refused (public resolver or too many queries)ACL options that stop spam and phishing
The ACL Options tab decides which connections Exim accepts. These make the biggest difference:
| Option | What it does | Recommendation |
|---|---|---|
| Dictionary attack protection | Drops connections that try many non-existent addresses | On |
| Reject SPF failures | Rejects mail whose domain states with SPF "-all" that this IP may not send for it | On |
| Ratelimit suspicious SMTP servers | Throttles servers that behave like spammers | On |
| Require HELO before MAIL | Requires the SMTP greeting before sending | On |
| Reject remote mail sent to the server's hostname | Rejects mail addressed to user@server-hostname, a typical spam target | On |
| Introduce a delay into the SMTP transaction for unknown hosts and messages detected as spam | Adds pauses that many bots won't wait for | On |
| Sender verification callouts | Asks the sender's server whether the address exists | Off: it creates traffic and delays, and can get your IP listed |
"Reject SPF failures" only acts when the sending domain publishes a strict SPF record. For domains using "~all" the mail goes through and SpamAssassin or your filter evaluates it. More on SPF in set up SPF, DKIM and DMARC in cPanel.
Verifying DKIM and DMARC on inbound mail
In the Security tab (or Mail, depending on the version) enable Allow DKIM verification for incoming messages. Exim adds the result to the Authentication-Results header, which SpamAssassin and email filters then use.
Rejecting every DKIM failure is a bad idea: forwarding and mailing lists break legitimate signatures all the time. It is safer to let the result add points in SpamAssassin and to apply the DMARC policy each domain publishes, which is exactly how a domain owner says what to do with failures.
Filtering dangerous attachments
In the Filters tab, Attachments: Filter messages with dangerous attachments rejects mail carrying executables and scripts (.exe, .scr, .pif, .bat, .vbs and similar), including those inside an unprotected ZIP. Turn it on: almost no legitimate business sends those formats by email.
Modern malware no longer travels that way. It uses HTML, ISO, OneNote files, PDFs with links or password-protected ZIPs, which this filter doesn't block. We explain it in malicious attachments and HTML smuggling.
The same tab has System Filter File, the Exim system filter that applies to all mail on the server. How to use it for your own rules: cPanel email filters.
Access lists: blocking or trusting specific IPs
The Access Lists tab stores exceptions in text files, one entry per line:
| List | File | Use |
|---|---|---|
| Blacklisted SMTP IP addresses | /etc/spammeripblocks | IPs that should never deliver mail, such as a server attacking you |
| Trusted SMTP IP addresses | /etc/trustedmailhosts | Your own servers, such as a scanner or an internal application, that shouldn't go through RBLs or checks |
| Hosts to skip SMTP checks | /etc/skipsmtpcheckhosts | Known servers that should skip SMTP checks, such as a forwarder that legitimately breaks SPF |
Every trusted IP skips important checks. Only add servers you run yourself and review the list every few months.
How to check that it works
After saving, WHM restarts Exim. Review rejections in the main log for a few days to catch false positives:
# Today's RBL rejections, grouped by list
grep "$(date +%F)" /var/log/exim_mainlog | grep -o "is in an RBL on [^ ,]*" | sort | uniq -c
# SPF rejections
grep "$(date +%F)" /var/log/exim_rejectlog | grep -ic "spf"
# See why a specific sender was rejected
grep "sender@example.com" /var/log/exim_rejectlog | tailIf a customer complains that mail from someone isn't arriving, the reject log tells you which rule stopped it. Before adding exceptions, check whether the sender has a real problem, such as being on a blocklist or having a broken SPF record. If it is your own IP that is listed, follow IP on a blocklist: how to check and get removed.
Frequently asked questions
Where is Exim configured in cPanel?
In WHM › Service Configuration › Exim Configuration Manager. The Basic Editor groups the options in tabs; the Advanced Editor lets you edit the configuration directly and is best left alone unless you know what you are doing.
Can enabling RBLs block legitimate mail?
It can happen, mostly with senders using poorly maintained servers. Spamhaus ZEN has very few false positives. Review the reject log during the first week and add exceptions only for verified senders.
Does Exim replace SpamAssassin?
No. Exim stops mail based on the connection and the sender; SpamAssassin analyzes content. They are complementary layers, and neither is designed for targeted phishing.
What if I change something and mail stops arriving?
The Exim Configuration Manager keeps configuration copies in the Backup tab. Restore the previous one and check /var/log/exim_paniclog and /var/log/exim_rejectlog to see what failed.
Antispam and antiphishing for your whole cPanel server
Exim stops spam by reputation. Clisec works at the same SMTP layer and adds the link, attachment and impersonation analysis that catches targeted phishing, with no MX changes.