How do you set up the email spam filter in Plesk?

Plesk ships with a full set of free anti-spam tools: the SpamAssassin content filter, DNS blocklists, SPF, DKIM and DMARC checks, and greylisting on Linux. Most of them are switched on in different places, and a few behave differently once mail reaches the server through an external filter.

This guide covers Plesk Obsidian, with menu paths from Plesk's documentation at the time of writing (October 2026). Where Linux and Windows differ, it says so.

What spam filtering does Plesk include?

Plesk includes SpamAssassin, a free open-source filter that scores each message against a large set of tests, plus connection-level checks that run before a message is accepted. Plesk's Protecting Against Spam page lists them:

If a term is new, our guides to how spam filters work, DNS blocklists and greylisting explain each one.

How do you turn on SpamAssassin in Plesk?

To switch on SpamAssassin for the whole server, follow Plesk's steps (Plesk docs):

1. Go to Tools & Settings > Spam Filter (under Mail).
2. Select Switch on server-wide SpamAssassin spam filtering.
3. Select Apply individual settings to spam filtering so mailbox owners can set their own actions and lists.
4. On Linux, leave Maximum processes at the default unless you have measured a need. The interface caps it at 32.
5. Set Required score. Plesk classifies messages that score "7 or more points" as spam by default. Lower is stricter.
6. Set the Spam tag, the subject prefix added to spam. The default is *****SPAM*****, and _SCORE_ adds the score.
7. Click OK.

Two limits matter here. Server-wide, Plesk only marks spam: it adds X-Spam-Flag and X-Spam-Status headers, and Plesk says "you cannot set the server-wide spam filter to automatically delete spam." And on Linux, the largest message SpamAssassin scans is set by SA_MAX_MAIL_SIZE in /etc/psa/psa.conf, which defaults to 256000 bytes. Larger messages skip content scanning.

Example headers on a message SpamAssassin marked as spam (values are illustrative):

X-Spam-Flag: YES
X-Spam-Status: Yes, score=9.2 required=7.0 tests=URIBL_BLOCKED,...
Subject: *****SPAM***** Your invoice is overdue

Our guide What is a spam score? explains how SpamAssassin adds up those tests.

How do users set the spam filter for their own mailbox?

Each mailbox has its own Spam Filter tab, under Mail > the email address (Plesk customer guide). Select Switch on spam filtering for this email address, then pick one action:

• Mark spam messages by adding the following text to message subject, for users who sort mail in their own client.
• Move spam to the Spam folder, the safest choice for most people because nothing is lost. It needs Plesk for Linux and IMAP. Plesk says "all messages are automatically removed from the Spam folder after 30 days."
• Delete all spam messages, only if you trust the filter. Deleted mail can't be recovered.

Under Show Advanced Settings, Spam filter sensitivity defaults to 7. Plesk says "The default value of seven works well in most situations," and advises changing it by one point at a time. Users can also train the filter by moving spam from Inbox to Spam and good mail from Spam to Inbox, and keep their own White list and Black list with * and ? wildcards.

Which other Plesk anti-spam settings should you turn on?

Turn these on under Tools & Settings > Mail Server Settings on Linux, in this order:

1. DNSBL: select Turn on spam protection based on DNS blackhole lists and add the blocklist zones you choose. Check each list's usage terms first, and test your server's IP against the major lists with the Blacklist Checker.
2. SPF: select Enable SPF spam protection to check incoming mail and choose a mode. The options run from "Only create Received SPF-headers, never block" to "Reject mail if SPF does not resolve to 'pass'" (Plesk docs). "Reject mail if SPF resolves to 'fail' (deny)" is a reasonable maximum; the stricter modes reject forwarded mail and senders with softfail records.
3. DKIM: select Verify incoming mail. Plesk says messages that fail the check are "marked with a special header"; it's the DMARC check that acts on failures. You can't turn DKIM verification off while DMARC is enabled.
4. DMARC: select Enable DMARC to check incoming mail. Plesk says DMARC already checks incoming mail by default on Linux. Plesk's knowledge base documents an optional command-line setting, plesk bin settings -s mail_dmarc_reject_at_smtp=true && plesk repair mail -y, to reject DMARC failures at SMTP time.
5. Greylisting: under Tools & Settings > Spam Filter, select Switch on server-wide greylisting spam protection if your users can accept delayed delivery from first-time senders.

Plesk has two kinds of server-wide lists, and they are easy to confuse. The Mail Server Settings white list holds IPs or networks that skip DNSBL checks only; Plesk says they can still be caught by SPF, DKIM, DMARC, greylisting or SpamAssassin. The Spam Filter white list skips SpamAssassin scanning for listed addresses or domains.

What are the limits of Plesk's built-in spam filter?

Plesk's own documentation is frank: "Plesk provides only basic SpamAssassin functionality," and complex rules mean editing SpamAssassin's configuration files by hand. Server-wide settings for Linux live in /etc/mail/spamassassin/local.cf (Plesk docs).

The bigger limit is where the filtering happens. Every check runs on your own server, after a sender has connected to it. That means:

• The server absorbs the load of every spam run, and SpamAssassin scanning competes with your websites for CPU and memory.
• Mail is only as available as the server. If it is down, senders retry on their own schedules and may eventually bounce.
• Each server, and on shared hosting each subscription, is configured separately.

For a single small site, Plesk's tools tuned as above are often enough. An MX-level filter, which receives mail before it reaches Plesk, helps when spam volume affects server performance, when you want mail held during maintenance, or when you host many customer domains. Our hosting providers page covers that case.

How do you point Plesk mail at an external spam filter?

To put an external filter in front of Plesk, keep Plesk's mail service on, change the MX record, then tell Plesk to trust the filter. The mailboxes stay on Plesk.

1. Configure the filter first with your Plesk server's hostname as the delivery destination, and send a test through it.
2. Leave the mail service enabled. Plesk's guide to external mail servers tells you to disable it under Mail > Mail Settings > Activate/Deactivate Services. That's for mailboxes hosted elsewhere; don't do it here.
3. Change MX. If Plesk hosts your DNS, go to Websites & Domains > DNS Settings and click the MX record to edit it (Plesk docs). If DNS is elsewhere, edit it there. Lower the TTL a day ahead and follow how to change MX records without losing email. Don't keep the Plesk server as a backup MX.
4. Stop SPF from rejecting filtered mail. Plesk's documentation doesn't cover external filters, so this is our advice rather than Plesk's. Behind a filter, Plesk sees the filter's IP, not the real sender's, so set SPF checking to "Only create Received SPF-headers, never block". Consider turning off Plesk's DMARC check too (it is on by default), and let the filter enforce authentication.
5. Add the filter's ranges to the Mail Server Settings white list (White List tab > Add Network) so DNSBL checks don't test the filter's own IPs.
6. Add a trusted_networks line with the same ranges to /etc/mail/spamassassin/local.cf, then restart SpamAssassin. SpamAssassin then runs its network tests against the hop before the filter (SpamAssassin docs). Plesk's knowledge base names local.cf as the file for custom server-wide settings, but warns that Plesk updates and changes saved on the Spam Filter page can overwrite custom lines. Keep a backup and check the line is still there after updates.
7. Close the direct route. On a server where every domain is filtered, use Tools & Settings > Firewall to allow inbound TCP 25 only from the filter (Plesk Firewall). Keep ports 587 and 465 open for your users. On shared servers with unfiltered domains, skip this step. Our guide to blocking filter bypass explains why this matters.
8. Test from two outside providers and check the Received headers with the Email Header Analyzer.

Example local.cf line (the ranges are documentation examples, not real filter addresses):

trusted_networks 192.0.2.0/24 198.51.100.0/24

Next steps

• Check that server-wide SpamAssassin is on and that individual settings are allowed.
• Review your SPF checking mode, especially if you plan to add a filter.
• Look up your domain's current MX with the MX Lookup tool.
• If you'd like spam stopped before it reaches the server, iBlockSpam filters at the MX level for Plesk and any other mail server, with per-domain pricing and unlimited mailboxes.