How to put an external spam filter in front of cPanel/WHM

Putting an external spam filter in front of cPanel/WHM means the internet delivers your domain's mail to the filtering service, and the filtering service delivers clean mail to Exim on your server. The MX change is simple. The details that decide whether it works well are Email Routing, trust settings in Exim and SpamAssassin, and closing the direct route to the server.

This guide is for server admins and hosts. For the short checklist, see the cPanel/WHM platform page.

What changes when mail goes through an external filter?

Before the change, a sending server looks up your MX record, finds your cPanel server and connects to it on port 25 (RFC 5321, section 5.1). Exim accepts the message, SpamAssassin scores it and Dovecot stores it.

After the change, the MX record names the filtering service. The service accepts the message, filters it, and opens a new SMTP connection to your server to deliver what passed. Three things follow:

The second row is the one that causes most problems. If Exim or SpamAssassin treat the gateway as the sender, SPF checks run against the wrong IP (RFC 7208), RBL lookups query the gateway and sender verification can misfire.

What do you need before you start?

• cPanel access to the domain, and WHM root access (or a host who will apply server-wide settings).
• A server hostname with a valid certificate, accepting connections on port 25.
• The filtering service's MX hostnames and delivery IP ranges. In this guide they appear as <GATEWAY-MX-HOSTS> and <GATEWAY-IP-RANGES>.
• Access to wherever the domain's DNS is hosted.
• A short TTL on the current MX records (300 seconds is common), set at least one old-TTL period ahead.

How do you set it up, step by step?

1. Configure the filtering service first. Add the domain and set the destination to your server's hostname on port 25. Send a test through it before touching DNS.

2. Set Email Routing to Local Mail Exchanger. Go to cPanel » Email » Email Routing, select the domain, choose Local Mail Exchanger and click Change. cPanel's documentation recommends this option "if your server uses a smart host or gateway to filter mail" (cPanel docs). The default, Automatically Detect Configuration, picks a mode from the lowest-numbered MX. If that MX is no longer the server, it can select Remote Mail Exchanger, and Exim will then refuse mail for the domain.

3. Add the gateway to Trusted SMTP IP addresses. In WHM » Service Configuration » Exim Configuration Manager » Basic Editor, open Access Lists and edit Trusted SMTP IP addresses. Add each range from <GATEWAY-IP-RANGES>. Entries in this list skip Exim's SMTP-time sender, recipient, spam and relay checks (cPanel docs). Do not confuse it with Sender verification bypass IP addresses, which is a separate, narrower list.

4. Tell SpamAssassin about the gateway. Add a trusted_networks line with the same ranges to /etc/mail/spamassassin/local.cf, then restart spamd (/scripts/restartsrv_spamd). With the gateway trusted, SpamAssassin applies its DNS blocklist and SPF tests to the hop before the gateway (SpamAssassin docs).

5. Adjust per-account spam settings. In cPanel » Email » Spam Filters, switch off Automatically Delete New Spam (Auto-Delete) while you tune, and use Move New Spam to a Separate Folder (Spam Box) instead (cPanel docs). Auto-Delete is permanent.

6. Change the MX records. Replace the old MX with <GATEWAY-MX-HOSTS>. Remove the server's own MX entry. Keeping it as a lower-priority backup leaves an open route around the filter.

7. Verify delivery. Send tests from at least two outside providers. Check the headers (see below) and the Exim log.

8. Close the direct route. After the old TTL has expired, restrict who can deliver to your server on port 25. The next section explains how.

How do you stop spam sent straight to the server?

Spammers do not have to use your MX. Many scan for mail servers and connect directly to the IP behind your hostname. RFC 5321 also lets senders fall back to a domain's A record when no MX exists, so a mail server that answers on port 25 is reachable regardless of what MX says.

You have two options.

Firewall restriction (server with only filtered domains). Allow inbound TCP 25 from <GATEWAY-IP-RANGES> only, using CSF, nftables or your provider's firewall. Keep ports 587 and 465 open for authenticated submission. Exim's outbound connections are unaffected because they use outgoing port 25.

Per-domain Exim ACL (shared server). If some domains on the server are not filtered, a port 25 restriction would cut them off. Instead, add a custom ACL in the recipient stage through Exim Configuration Manager » Advanced Editor. A typical pattern, with one domain per line in the first file and one IP range per line in the second:

deny
  message       = Mail for this domain must arrive via its MX
  domains       = /etc/exim_filtered_domains
  !hosts        = /etc/exim_gateway_ips
  !authenticated = *

Test this on a staging server first. ACL insertion points in the Advanced Editor can change between cPanel versions, and a mistake in the recipient ACL can block all mail.

How should SpamAssassin and the external filter work together?

Treat SpamAssassin as a second, gentle layer. The external filter has already dropped or quarantined most junk, so the mail SpamAssassin sees is mostly legitimate. That makes false positives the main risk.

• Keep the threshold at the default or higher.
• Keep Auto-Delete off. A message deleted on the server can't be released from anywhere.
• Make sure trusted_networks is set. Without it, a single gateway IP that appears on a blocklist would add points to every message.
• If users report the same message in both the quarantine and the Spam Box, that is normal. They are separate layers.

How do you verify it's working?

• Headers: the Received line just above your server's should be the filtering service. Paste headers into the Email Header Analyzer; it runs in your browser.
• Exim log: grep "<message-id>" /var/log/exim_mainlog shows the connecting host.
• Direct test: from a server that is not the gateway, connect to your server on port 25 and try to deliver to a filtered domain. After step 8 it should be refused.
• DNS: the MX Lookup tool shows the public records. An MX lookup can't prove mail is filtered; the direct test can.

How do you roll back safely?

1. Remove the port 25 restriction or the Exim ACL first.
2. Point MX back to the server with a short TTL.
3. Leave Email Routing on Local Mail Exchanger. It is the correct mode when the server holds the mailboxes.
4. Keep the filtering service active until the old TTL expires, then remove the gateway from Trusted SMTP IP addresses and trusted_networks.

What are the risks and common mistakes?

• Email Routing left on Automatically Detect. The server may stop accepting its own domain's mail.
• Locking port 25 on a shared server. Unfiltered domains stop receiving mail.
• Over-broad trusted lists. Every trusted range skips checks. List only the gateway.
• Backup MX on the server. It defeats the filter.
• Forwarders on the server. Mail forwarded off-server is sent from your IP. Forwarding spam that slipped past both layers can affect your server's reputation, so prefer Sender Rewriting or local delivery.

How iBlockSpam helps

iBlockSpam is an MX-level filter built for this setup. The setup wizard shows your exact MX hosts and IP ranges, a before/after DNS comparison and rollback steps. Each user gets a personal quarantine with scheduled digests, and admins get a shared domain quarantine. If your server goes down, mail is held for up to 5 days. Pricing is per domain with unlimited mailboxes, and 100,000 inbound messages per month are included. Domain monitoring alerts you if MX, SPF or DMARC records drift. iBlockSpam does not change your server, so the Exim and firewall steps above remain yours to apply.

Next steps

1. Confirm Email Routing is set to Local Mail Exchanger for each filtered domain.
2. Check the public MX answer with the MX Lookup, then confirm the delivery path in a test message's headers with the Email Header Analyzer.
3. For the iBlockSpam-specific values, see the cPanel/WHM platform page.

Hosting providers can offer this across customer domains; see our hosting providers page and the SpamExperts alternative comparison.

See all spam filter setup guides.