# How do you configure cPanel spam filters and SpamAssassin?

URL: https://iblockspam.com/blog/cpanel-spam-filters-spamassassin-settings
Last updated: 2026-10-16
Published: 2026-10-16
Topic: Setup guides
Author: iBlockSpam Team

> What each cPanel Spam Filters setting does: threshold score, Spam Box, Auto-Delete, whitelist and blacklist, plus the WHM SpamAssassin and RBL options.

## Short answer

Open cPanel » Email » Spam Filters, turn on Process New Emails and Mark them as Spam, then turn on Move New Spam to a Separate Folder (Spam Box). Start the Spam Threshold Score at SpamAssassin's default of 5, leave Auto-Delete off until you trust the results, and use the whitelist sparingly because sender addresses are easy to forge.

cPanel's Spam Filters page is a front end for Apache SpamAssassin, a free filter that gives each message a score from many tests and treats it as spam above a threshold. The page has only a few switches, but the choices you make there decide whether spam is tagged, moved or deleted, and whether legitimate mail gets lost along the way.

This guide explains every setting on the cPanel page, then the server-wide options in WHM that only administrators can change. Menu names are from cPanel's documentation at the time of writing (October 2026). If you want to put an external filter in front of the server instead, see [how to route cPanel/WHM mail through an external spam filter](https://iblockspam.com/blog/external-spam-filter-cpanel-whm).

## Where are the spam filter settings in cPanel?

The spam filter settings are at **cPanel » Home » Email » Spam Filters** ([cPanel docs](https://docs.cpanel.net/cpanel/email/spam-filters/)). If you can't find the icon, your host has probably hidden it with WHM's Feature Manager, and you'll need to ask them to enable it.

## What does each cPanel Spam Filters setting do?

Each setting changes one step: scoring, where spam goes, or how a sender is treated.

| Setting (as labeled in cPanel) | What it does | Suggested starting value |
|---|---|---|
| Process New Emails and Mark them as Spam | Turns on SpamAssassin scoring for the account. Required for the next two | On |
| Move New Spam to a Separate Folder (Spam Box) | Puts messages over the threshold in a folder named `spam` | On |
| Automatically Delete New Spam (Auto-Delete) | Permanently deletes messages at or above the Auto-Delete threshold | Off |
| Spam Threshold Score | The score at which a message is marked as spam | 5 |
| Whitelist (Emails Always Allowed) | `whitelist_from` entries that SpamAssassin always lets through | Empty, or a few exact addresses |
| Blacklist (Emails Never Allowed) | `blacklist_from` entries that are always marked as spam | Persistent senders only |
| Calculated Spam Score Settings | Overrides the score of individual SpamAssassin tests | Leave alone |

cPanel adds three warnings worth repeating. Auto-Delete "could include non-spam messages, which would cause you to lose those messages." Only advanced users should change test scores, because "Improper configurations will create unintended consequences." And BoxTrapper, cPanel's challenge-response tool, may cause problems when used together with SpamAssassin.

## What spam threshold score should you use in cPanel?

Start at 5. That is SpamAssassin's built-in default for `required_score`, the "score required before a mail is considered spam" ([SpamAssassin docs](https://spamassassin.apache.org/full/4.0.x/doc/Mail_SpamAssassin_Conf.html)). SpamAssassin itself calls 5.0 "quite aggressive", suitable for a single-user setup, and suggests ISPs use something more conservative, such as 8.0 or 10.0. cPanel's page doesn't state its own default, so check what your account shows.

cPanel explains the direction: lower values are more aggressive and may flag legitimate mail, higher values flag only obvious spam, with examples of 1 and 10. In practice:

- **3 to 4:** strict. Expect more legitimate mail, such as newsletters, in the Spam Box.
- **5:** SpamAssassin's default and a sensible start.
- **6 to 8:** relaxed. Use it if legitimate mail keeps being flagged, or if another filter already sits in front of the server.

Change the score one point at a time and wait a few days between changes. To see why a particular message scored as it did, open its headers. SpamAssassin adds lines like this example (values are illustrative):

```
X-Spam-Status: Yes, score=7.4 required=5.0 tests=BAYES_99,HTML_MESSAGE,
  RDNS_NONE,URIBL_BLOCKED autolearn=no
X-Spam-Flag: YES
```

Paste the full headers into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to read them more easily. Our guide [What is a spam score?](https://iblockspam.com/blog/what-is-a-spam-score) explains how the tests add up.

## How do you set up cPanel spam filters step by step?

1. Go to **cPanel » Email » Spam Filters**.
2. Turn on **Process New Emails and Mark them as Spam**.
3. Turn on **Move New Spam to a Separate Folder (Spam Box)**. If the option is missing, your host has switched Spam Box delivery off in WHM; spam will then arrive in the inbox, possibly with "SPAM" in the subject.
4. Click **Spam Threshold Score**, choose **5** (or **Custom**), then click **Update Scoring Options**.
5. Leave **Auto-Delete** off for at least the first few weeks.
6. Click **Show Additional Configurations** only if you need whitelist or blacklist entries (see below).
7. Tell your users to check the `spam` folder. In webmail and IMAP it appears as a folder. POP3 users sign in with their address followed by `/spam`, for example `jane@example.com/spam`, and their normal password.
8. Empty the Spam Box periodically under **Configure Spam Box Settings**. cPanel notes that it counts toward the mailbox quota.

## How do the cPanel whitelist and blacklist work?

The whitelist and blacklist match the sender's address, and both accept `*` for any characters and `?` for one character. Example entries:

```
billing@supplier.example
*@newsletter.example
```

Use the whitelist sparingly. SpamAssassin's documentation, which now calls this setting `welcomelist_from`, says its use "is not recommended, since it blindly trusts the message, which is routinely and easily forged by spammers and phish senders" ([SpamAssassin docs](https://spamassassin.apache.org/full/4.0.x/doc/Mail_SpamAssassin_Conf.html)). The safer SpamAssassin alternative, `welcomelist_auth`, first checks that the sender is authorized for the address, but cPanel's interface doesn't offer it.

Three rules keep the whitelist from becoming a hole:

- Never whitelist your own domain. Spoofed mail "from" your domain would skip filtering.
- Avoid `*@` entries for large free mail providers.
- Prefer fixing the cause. Most misflagged mail comes from a sender's broken SPF, DKIM or DMARC; see [why legitimate email gets flagged](https://iblockspam.com/blog/false-positives-legitimate-email-flagged).

The blacklist is safe to use but limited. Spammers change addresses constantly, so it helps against one persistent sender, not spam in general. To block senders for many accounts at once, cPanel points administrators to the Exim system filter file.

## What can WHM administrators change server-wide?

Several settings are only available in WHM, so on shared hosting you need your host for them ([Tweak Settings](https://docs.cpanel.net/whm/server-configuration/tweak-settings/mail/), [Exim Basic Editor](https://docs.cpanel.net/whm/service-configuration/exim-configuration-manager-basic-editor/)).

| WHM setting | Location | Default |
|---|---|---|
| Enable Apache SpamAssassin spam filter | Tweak Settings » Mail | On |
| Enable Apache SpamAssassin Spam Box delivery for messages marked as spam (user configurable) | Tweak Settings » Mail | On |
| Apache SpamAssassin: Forced Global ON | Exim Configuration Manager » Apache SpamAssassin Options | Off |
| Apache SpamAssassin: message size threshold to scan | Exim Configuration Manager » Apache SpamAssassin Options | 1000 KB |
| Apache SpamAssassin reject spam score threshold | Exim Configuration Manager » ACL Options | No reject rule by spam score |
| Apache SpamAssassin: Global Subject Rewrite | Exim Configuration Manager » Filters | On |
| RBL: bl.spamcop.net and RBL: zen.spamhaus.org | Exim Configuration Manager » RBLs | Off |
| Scan outgoing messages for spam and reject based on the Apache SpamAssassin internal spam_score setting | Exim Configuration Manager » Apache SpamAssassin Options | Off |

Points for administrators:

- **Messages above the size threshold aren't scanned.** At 1000 KB, a message with a large attachment skips SpamAssassin entirely.
- **The reject threshold refuses mail at SMTP time**, so the sender gets a bounce and nothing reaches a Spam Box. If you set one, make it well above users' thresholds.
- **RBLs** (real-time blocklists of known spam sources) reject mail at SMTP time and are off by default. Each list has its own usage terms, so check them before enabling. Background: [what is an email blocklist](https://iblockspam.com/blog/what-is-an-email-blocklist-dnsbl).
- **Outbound scanning** helps catch a compromised account sending spam before your server's IP lands on a blocklist. Check yours with the [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker).
- After changing SpamAssassin's configuration files, cPanel says to run `/usr/local/cpanel/3rdparty/bin/sa-compile` for the changes to take effect.

## What can't cPanel spam filters do?

cPanel's spam filters do a reasonable job for a small site, but they have built-in limits:

- **They run after the server accepts the message.** Your server absorbs the connection, the scanning and any malware, and SpamAssassin competes with your websites for CPU.
- **Large messages are skipped** above the scan size threshold.
- **There is no central quarantine.** Spam sits in each mailbox's `spam` folder, so nobody gets a digest of what was held, and an admin can't review it across accounts.
- **Auto-Deleted mail is gone.** Nothing can release it.
- **Nothing holds mail if the server is down.** Senders retry on their own schedules.

An MX-level filter, which your MX record points to so mail is filtered before it reaches Exim, addresses those limits. If you add one, set **Email Routing** to **Local Mail Exchanger**, which cPanel says to choose "if your server uses a smart host or other gateway service to filter mail" ([cPanel docs](https://docs.cpanel.net/cpanel/email/email-routing/)), and raise the SpamAssassin threshold so it acts as a gentle second layer. The full procedure, including Exim trust settings and closing port 25, is in our [external filter guide](https://iblockspam.com/blog/external-spam-filter-cpanel-whm). Before switching, follow [how to change MX records without losing email](https://iblockspam.com/blog/change-mx-records-without-losing-email).

## Next steps

- Check that Spam Box is on and Auto-Delete is off for every account you manage.
- Review the whitelist and remove entries for your own domain or whole free mail providers.
- Run the [Email Health Check](https://iblockspam.com/tools/email-health-check) on your domain to confirm its MX, SPF and DMARC are in order.
- If you'd rather stop spam before it reaches the server, our [cPanel/WHM setup page](https://iblockspam.com/platforms/cpanel-whm) shows how iBlockSpam sits in front of Exim, with a personal quarantine and digests for each user.

## Frequently asked questions

### What is a good spam threshold score in cPanel?

Start at 5, which is SpamAssassin's own default required score. If legitimate mail keeps landing in the Spam Box, raise it by one point. If obvious spam keeps reaching the inbox, lower it by one point and watch for false positives for a few days. cPanel notes that a low score such as 1 is aggressive.

### Is it safe to turn on Auto-Delete in cPanel?

Only with care. cPanel warns that Auto-Delete permanently deletes messages at or above its threshold, which may include legitimate mail. Leave it off while you tune the filter. If you turn it on later, set its threshold well above the Spam Threshold Score so only very high-scoring messages are deleted unseen.

### Where does cPanel put spam when the Spam Box is on?

In a folder named spam inside each mailbox. Webmail and IMAP clients show it as a folder. POP3 users reach it by signing in with their email address followed by /spam and their normal password. The folder counts toward the mailbox quota, so cPanel suggests emptying it occasionally.

### Why doesn't the cPanel whitelist stop spam from a whitelisted sender?

The whitelist trusts the From address, which spammers can forge. SpamAssassin's documentation says such entries are not recommended because they blindly trust the message. Whitelist a specific address only when its mail is repeatedly misflagged, avoid whole-domain entries for common providers, and never whitelist your own domain.

### Can my host force SpamAssassin on for my cPanel account?

Yes. In WHM, the setting Apache SpamAssassin Forced Global ON turns the filter on for every account and stops users from disabling it. cPanel's Spam Filters page notes that when your provider forces it on, you can't switch off Process New Emails and Mark them as Spam. Hosts can also hide the interface entirely.

## Sources

- [cPanel docs: Spam Filters](https://docs.cpanel.net/cpanel/email/spam-filters/)
- [cPanel docs: Tweak Settings, Mail tab](https://docs.cpanel.net/whm/server-configuration/tweak-settings/mail/)
- [cPanel docs: Exim Configuration Manager Basic Editor](https://docs.cpanel.net/whm/service-configuration/exim-configuration-manager-basic-editor/)
- [cPanel docs: Email Routing](https://docs.cpanel.net/cpanel/email/email-routing/)
- [Apache SpamAssassin: Mail::SpamAssassin::Conf (4.0.x)](https://spamassassin.apache.org/full/4.0.x/doc/Mail_SpamAssassin_Conf.html)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker): Check an IPv4 or IPv6 address, or your mail servers, against public spam blocklists, with policy and delisting links.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/cpanel-spam-filters-spamassassin-settings (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt