In short
SpamAssassin scores every email with generic rules and reputation lists built for bulk spam. Targeted phishing and BEC fraud are written for one specific recipient, arrive from new domains or legitimate compromised accounts, and often have no links or attachments: they barely score any points and land in the inbox.
How SpamAssassin decides
Every SpamAssassin rule adds or subtracts points: typical spam wording, malformed headers, senders on block lists, SPF and DKIM results. If the total crosses the threshold, the message gets flagged. It's effective against mass campaigns, which repeat across thousands of inboxes and end up on reputation lists.
Targeted phishing works the opposite way: it's a single message, written for one person or company, designed to look normal. That's why it triggers so few rules.
Five reasons phishing gets through
- Recently registered domains. A domain created days ago still doesn't appear on any block list.
- Legitimate compromised accounts. If the attacker writes from a vendor's real inbox, the message passes SPF and DKIM, because it really did come from there.
- Messages with no links or attachments. BEC fraud is often just text: "we changed bank accounts, please pay this invoice to the new one."
- Links to legitimate services. Forms, shared documents or cloud storage that no list blocks, but that lead to a page built to steal passwords.
- Domains that look like a known one.
micr0soft-login.coorprovider-cl.comdon't trigger generic rules, because the filter doesn't compare them against your users' usual senders.
Which signals actually give phishing away
Catching targeted phishing means looking at the context of each message, not just its content:
- Whether the sender is writing to that recipient for the first time.
- How old the domain is and how similar it looks to known domains.
- Whether SPF, DKIM and DMARC line up with the domain the user actually sees.
- Where each link actually leads, by checking the destination page.
- Attachments with macros, HTML files or unusual formats.
- Urgent language, requests for secrecy, and changes to bank details.
SpamAssassin versus an anti-phishing layer
| Situation | SpamAssassin | Clisec |
|---|---|---|
| Known bulk spam | Catches it | Catches it |
| Targeted phishing and impersonation | Limited | Specific detection |
| BEC fraud with no links or attachments | Limited | Specific detection |
| Link to a fake login page | Only if it's on a list | Analyzes links and destination pages |
| Malware in attachments | Needs ClamAV separately | Included |
| Reason for each decision | Headers inside the message | Log with reason, timestamp and SMTP transcript |
What to do today on your server
- Set up SPF, DKIM and DMARC on every domain on the server.
- Review your allow lists and remove whole domains.
- Turn on ClamAV in WHM to scan attachments.
- Explain BEC fraud warning signs to your clients. You can use our BEC fraud guide.
- Add a layer specialized in phishing and BEC that analyzes the context of each message, like Clisec for cPanel.
Frequently asked questions
Can I tune SpamAssassin to detect phishing?
Partly, with custom rules and stricter thresholds. But every adjustment increases false positives, and you have to maintain the rules by hand, account by account, as attacks change.
Does DMARC stop phishing?
DMARC stops someone from sending mail using exactly your domain. It doesn't protect against look-alike domains or compromised third-party accounts, which are the basis of targeted phishing.
Does Clisec change MX records?
No. Clisec filters incoming mail on your own cPanel server and turns on when the agent is installed, without changing any domain's MX records.
When SpamAssassin isn't enough
Clisec filters incoming mail across your whole cPanel server and adds detection for targeted phishing, BEC fraud and malware, without changing MX records.