Spam filter setup guides for Microsoft 365, Google Workspace and cPanel
Step-by-step instructions for running a spam filter in front of Microsoft 365, Google Workspace and cPanel/WHM.
25 guides
How do you configure Gmail spam and phishing settings in Google Workspace?
Configure Gmail spam, phishing and malware settings in the Google Workspace Admin console: safety settings, approved senders, quarantine and gateway caveats.
9 min read Setup guidesHow do you protect the domain your email depends on?
Protect the domain your email depends on: registrar MFA, transfer lock vs registry lock, auto-renew, contact addresses and DNS host security, plus a checklist.
10 min read Setup guidesHow do Exchange Server's built-in anti-spam agents work, and are they enough?
Exchange Server's built-in anti-spam agents: what each does, Mailbox vs Edge, installing with Install-AntiSpamAgents.ps1, their limits, and adding a hosted gateway.
10 min read Setup guidesHow do you enforce 2-Step Verification in Google Workspace without locking people out?
How to enforce 2-Step Verification in Google Workspace without lockouts: enrollment periods, security key and passkey only mode, backup codes, and admin rules.
10 min read Setup guidesHow do you set up advanced phishing and malware protection in Google Workspace?
What each Gmail Safety setting in Google Workspace does, how warning, spam and quarantine actions affect users, and which editions get Security Sandbox.
10 min read Setup guidesHow do you use Gmail content compliance rules to improve email security in Google Workspace?
Use Gmail content compliance, objectionable content and attachment compliance rules for security: expressions, actions, rule order and three worked examples.
10 min read Setup guidesHow do you set up the advanced delivery policy for phishing simulations in Microsoft 365?
Set up the Microsoft 365 advanced delivery policy for third-party phishing simulations and SecOps mailboxes: domains, sending IPs, URLs, limits and pitfalls.
9 min read Setup guidesMicrosoft 365 anti-phishing policy settings: what each one does
Every Microsoft 365 anti-phishing setting explained: spoof, impersonation, mailbox intelligence, phishing thresholds 1 to 4, safety tips and Standard vs Strict.
10 min read Setup guidesHow do you configure anti-spam policies in Microsoft 365?
Every Microsoft 365 anti-spam policy setting explained: bulk threshold, verdict actions, ZAP, quarantine policies, allow lists, outbound limits and IP Allow List.
10 min read Setup guidesHow do you set up Attack simulation training in Microsoft 365?
Run phishing simulations with Microsoft 365 Attack simulation training: licensing, the seven techniques, payloads, training assignment, reports and fair use.
10 min read Setup guidesMicrosoft 365 connectors explained: when you need them and how they work
When Exchange Online needs inbound or outbound connectors: Partner vs on-premises types, TLS certificate and IP matching, smart hosts, validation and mistakes.
9 min read Setup guidesWhat are Microsoft 365 preset security policies, and should you use them?
Built-in protection, Standard and Strict preset security policies in Microsoft 365: what each covers, how they override custom policies, and when to go custom.
9 min read Setup guidesHow do Safe Links and Safe Attachments work in Microsoft 365, and how do you set them up?
What Safe Links and Safe Attachments do, who is licensed, what Built-in protection sets, Dynamic Delivery, URL rewriting, and how they work behind a gateway.
10 min read Setup guidesWhat does the SMTP AUTH Basic auth retirement mean for your Microsoft 365 tenant?
Microsoft is turning off Basic auth for SMTP AUTH in Exchange Online. The current timeline, who is affected, how to find them, and the options to switch to.
9 min read Setup guidesHow does spoof intelligence work in Microsoft 365?
Use the Microsoft 365 spoof intelligence insight, allow or block spoofed sender pairs, read compauth reason codes and explain the ? and via tags in Outlook.
9 min read Setup guidesHow do you add SPF, DKIM and DMARC records in Cloudflare?
Step-by-step: add SPF, DKIM, DMARC and MX records in Cloudflare DNS, why mail hostnames must be DNS only, how TXT quoting works, and how to check your records.
8 min read Setup guidesHow do you add email DNS records in GoDaddy?
How to add and edit SPF, DKIM, DMARC and MX records in GoDaddy DNS: exact fields, the one-SPF-record rule, Domain Protection checks and how to verify them.
8 min read Setup guidesHow do you add email DNS records in Namecheap?
How to add SPF, DKIM and DMARC TXT records and custom MX records in Namecheap Advanced DNS, what goes in the Host field, and how to check that they work.
8 min read Setup guidesHow do you set up DMARC for Microsoft 365 domains?
Publish DMARC for your custom domains and the onmicrosoft.com domain in Microsoft 365, roll out safely to p=reject, and check how inbound DMARC is enforced.
9 min read Setup guidesHow to put an external spam filter in front of cPanel/WHM
Put an external MX-level spam filter in front of cPanel/WHM: Email Routing, trusted SMTP IPs, blocking direct-to-server spam and SpamAssassin tuning.
9 min read Setup guidesHow to set up a Google Workspace inbound gateway for a spam filter
Configure Gmail's Inbound gateway for an MX-level spam filter: gateway IPs, external IP detection, direct-mail rejection, TLS, DMARC and rollback.
9 min read Setup guidesHow do you set up scan to email and app SMTP with Microsoft 365?
Set up a printer, scanner or app to send through Microsoft 365: SMTP AUTH on port 587, Direct Send or a relay connector, and the Basic auth retirement plan.
9 min read Setup guidesHow to use an external spam filter with Microsoft 365 and Enhanced Filtering for Connectors
How to run an MX-level spam filter in front of Exchange Online: Partner connector, Enhanced Filtering for Connectors, why not SCL -1, headers and rollback.
10 min read Setup guidesHow do you set up email on a new business domain?
Setting up email on a new business domain? Follow this checklist: MX, SPF, DKIM, DMARC from p=none to enforcement, optional MTA-STS and BIMI, PTR and warm-up.
10 min read Setup guidesHow do you add an external email warning tag in Outlook and Microsoft 365?
Turn on the native External tag in Outlook with Set-ExternalInOutlook, or add a mail flow rule banner. Steps, exceptions and the trade-offs of each approach.
9 min readAbout these guides
Putting a filtering service in front of your mailboxes takes the same three moves on every platform. First, tell your mail platform to trust mail arriving from the filter. Second, point your MX records at the filter. Third, close the side door, so senders can't deliver straight to your mailboxes and skip the filter. What differs between platforms is where each setting lives and what it's called.
These step-by-step guides cover each platform in detail:
- Microsoft 365: an inbound connector for the filter's IP addresses, and Enhanced Filtering for Connectors so Microsoft evaluates the original sender rather than the filter.
- Google Workspace: an inbound gateway with the filter's IP ranges, then "Reject all mail not from gateway IPs" once mail is flowing through the filter.
- cPanel/WHM: Email Routing set to Local Mail Exchanger, the filter's ranges trusted by Exim and SpamAssassin, and inbound port 25 restricted.
Do the steps in that order. Before you change anything, note your current records so you can roll back, and lower the TTL on your MX records a day ahead; changing MX records without losing email covers the timing. Afterwards, send a test message from an outside account and check its headers with the free Email Header Analyzer. Closing the side door has its own guide, including how to test it.
Frequently asked questions
In what order should I set up a spam filter in front of my mail platform?
First add the filter to your platform as a trusted inbound source, such as a connector or inbound gateway. Then lower your MX TTL, change MX to the filter and watch mail arrive through it. Only after that, close direct delivery so senders can't skip the filter. Doing it in a different order risks rejected or misjudged mail.
Do my users or mailboxes change when I add a gateway filter?
Usually not. Mailboxes, addresses and passwords stay where they are on Microsoft 365, Google Workspace or cPanel, and users keep the same mail apps. The changes are to DNS (your MX records) and to a few admin settings that tell your platform to trust mail from the filter.
Why should I block direct delivery after changing MX?
Because MX records only tell senders where to deliver; they don't stop anyone connecting to your mailbox provider directly. Spammers use that route to skip the filter. A connector rule in Microsoft 365, Reject all mail not from gateway IPs in Google Workspace, or a port 25 restriction on cPanel makes the filter the only way in.