Spam filter for DirectAdmin: MX-level filtering in front of Exim

This page shows how to put iBlockSpam in front of a DirectAdmin server so that internet mail is filtered before Exim accepts it. The mailboxes stay on DirectAdmin; only the route mail takes to reach them changes.

DirectAdmin's interface differs by skin and version, and some account types can't see every setting. Labels below are from DirectAdmin's documentation and forum at the time of writing (October 2026), so yours may differ slightly.

Placeholders used below:

• <GATEWAY-MX-HOSTS>: the MX hostnames for your domain.
• <GATEWAY-IP-RANGES>: the IP ranges the filtering service delivers from.
• <SERVER-HOSTNAME>: your server's mail hostname, for example server1.example.net.

The iBlockSpam setup wizard shows your exact values, a before/after DNS comparison and the rollback steps.

Prerequisites

• A DirectAdmin user with DNS control for the domain, or access to wherever the domain's DNS is hosted.
• Root access for the server-wide steps (SpamAssassin, Exim files, firewall), or a host who can apply them.
• The server has a hostname with a valid TLS certificate and accepts mail on port 25. DirectAdmin's firewall documentation lists ports 25, 465 and 587 for Exim (DirectAdmin docs: Firewall).
• An outside test mailbox.

Step by step

1. Add your domain in iBlockSpam. Set the delivery destination to <SERVER-HOSTNAME> on port 25. The wizard checks that it can connect.

2. Lower the MX TTL to 300 seconds at least one full old-TTL period before the cutover. Our guide to DNS TTL and MX propagation explains the timing.

3. Keep Local Mail Server ticked. In User Panel » your domain » MX Records, DirectAdmin has a Local Mail Server option. Its documentation says to untick it when you use a remote mail server; unticking it removes the domain from /etc/virtual/domains, "the file that specifies the domains to use the local mailserver" (DirectAdmin docs: Customizing email defaults, Exim troubleshooting). Here the mailboxes stay on the server, so leave it ticked when you change MX.

4. Tell SpamAssassin the filter is trusted. If SpamAssassin is installed (DirectAdmin's docs install it with CustomBuild, DirectAdmin docs: Incoming spam), add this line as root to SpamAssassin's local.cf, usually in /etc/mail/spamassassin/, listing the ranges separated by spaces, then restart it:

   trusted_networks <GATEWAY-IP-RANGES>
   

   SpamAssassin then runs its network tests against the hop before the filter (Apache SpamAssassin configuration). If you use Rspamd instead, check how your Rspamd setup treats relays before the cutover.

5. Review user spam settings. Each user enables and tunes SpamAssassin from the SpamAssassin Setup page at User Level. During the first weeks, have spam sent to the user's spam folder rather than deleted. Spam caught by iBlockSpam goes to quarantine; anything flagged afterwards stays recoverable.

6. Change MX. Replace the MX records with <GATEWAY-MX-HOSTS> and the priorities shown in the wizard, in DirectAdmin's DNS management if the server hosts DNS, or at your DNS host. Do not keep the server as a backup MX: senders may use any listed MX (RFC 5321, section 5.1), and that gives spammers a direct path.

7. Watch Exim's checks at connection time. Exim's blocklist (RBL) checks and similar rules now see the filter's IP address, not the original sender's. If the Exim main log shows filtered mail being refused, DirectAdmin documents /etc/virtual/whitelist_hosts_ip for sending IPs and ranges, with the warning that the whitelists "may bypass all scanning" (DirectAdmin docs: Incoming spam). Add only the filter's exact ranges, and only if you need to.

8. Close the direct route. Removing the server from MX does not stop spammers who connect to its IP address directly. Once the old TTL has expired:

   • Server with only filtered domains: with CSF, the firewall DirectAdmin integrates, remove port 25 from TCP_IN (and TCP6_IN if the server uses IPv6) and allow it from the filter's ranges with CSF's advanced filter syntax in /etc/csf/csf.allow, one line per range, for example tcp|in|d=25|s=192.0.2.0/24 (DirectAdmin docs: CSF). Keep ports 587 and 465 open for your users.
   • Shared server with unfiltered domains: skip the firewall step, because it would cut off their mail. Our direct-to-server guide explains the trade-offs.

How to verify

Send a test from an outside mailbox and view the full headers in webmail, or paste them into the Email Header Analyzer, which runs in your browser.

• Received: the hop before your server should be the filtering service.
• X-Spam-Status (if SpamAssassin is on): network-based rules should reflect the original sender. A sudden rise in blocklist hits suggests trusted_networks is missing.
• Exim main log: search for the message ID to see the connecting host for each delivery. After step 8, direct connections from other IPs should fail.

Use the MX Lookup tool to confirm the public records.

Rollback

1. Remove the port 25 restriction first, so direct mail is accepted again.
2. Change MX back to the server, with a short TTL.
3. Keep Local Mail Server ticked. It is correct whenever the server holds the mailboxes.
4. Keep the iBlockSpam domain active until the old TTL expires, then remove the filter's ranges from trusted_networks and any Exim whitelist file you used.

Common mistakes

• Unticking Local Mail Server. The domain is removed from /etc/virtual/domains, so the server treats its mail as hosted elsewhere.
• Whitelisting broadly. Entries in Exim's whitelist files skip checks for every message from those hosts. Keep them to the filter's exact ranges.
• Keeping the server as a lower-priority MX. That is the route spammers use to skip the filter.
• Closing port 25 on a shared server. Domains not filtered by iBlockSpam stop receiving mail.
• Deleting spam on a low score. Deleted mail cannot be recovered. Prefer the spam folder while you tune.

Outbound mail and SPF

Nothing in this setup changes how Exim sends mail. It keeps delivering outbound mail directly, so your SPF record stays as it is (RFC 7208). Add iBlockSpam to SPF only if you later route outbound mail through the iBlockSpam outbound relay, which includes 500 messages per domain each month. DirectAdmin documents smarthost setup for Exim separately.

Limits

• Each domain includes 100,000 inbound messages per month and accepts messages up to 400 MB. Exim's own message size limit also applies, and the smaller limit wins.
• Unlimited mailboxes means any number of mailboxes per domain, not unlimited message volume.
• Mail is spooled for up to 5 days if the server is down. Message history is kept for 30 days.
• An MX lookup can't prove mail is filtered. Headers, logs and a direct-connection test are the evidence.

Hosting providers can offer filtering across customer domains, with partner terms agreed individually; see partners and our page for hosting providers. Other platforms are on the platforms page. Stuck on a step? Our support page lists what to send so we can trace mail quickly.