On a cPanel & WHM server, most of the spam that reaches your users can be stopped before it is ever accepted, with a handful of settings in WHM's Exim Configuration Manager: DNS blocklists (RBLs), HELO checks and SpamAssassin thresholds. This guide explains which settings to turn on, what each one does, and how to check that legitimate mail still gets through.
Exim Configuration Manager is in WHM, which only the server's root administrator can open, on a server you run cPanel & WHM on. It is not in cPanel, and Domain India shared hosting customers can't change the mail server's settings, because they apply to every account on the server. On shared hosting, use the spam tools in your own control panel; see section 8.
In WHM, open Exim Configuration Manager's Basic Editor. Turn on the Spamhaus and SpamCop RBLs (checking Spamhaus's usage terms first), add others such as Barracuda under Manage Custom RBLs, and turn on the HELO checks. Set a SpamAssassin reject threshold well above the default spam score of 5, such as 10 to 15, so only obvious spam is refused at SMTP time and borderline mail is still delivered and marked. Save, then watch the reject log for a few days to catch false positives.
1. Why filter at the SMTP stage
Exim can refuse a message during the SMTP conversation, before it accepts it. That has three advantages over filtering after delivery:
- the sending server gets the rejection and the real sender can see why, so nothing is lost silently;
- your server never stores, scans or bounces the junk, which saves CPU and disk;
- you never send backscatter (bounces to forged senders), which can get your own server's IP address listed.
2. Open Exim Configuration Manager
- Log in to WHMas root.
- Open Exim Configuration Manager.It is under Service Configuration; you can also type "Exim" in WHM's search box.
- Choose Basic Editor.The settings are grouped into tabs such as ACL Options, RBLs and Apache SpamAssassin Options. Option names can differ slightly between cPanel versions.
- Make your changes and click Save.WHM rebuilds the Exim configuration, checks it and restarts Exim.
Before a large change, use the Backup tab in Exim Configuration Manager to save the current configuration, so you can restore it if something goes wrong.
3. Turn on DNS blocklists (RBLs)
An RBL is a list of IP addresses known to send spam. Exim looks up each connecting server's IP address and refuses the connection if it is listed.
WHM includes two ready-made RBL options:
- RBL: zen.spamhaus.org combines Spamhaus's main lists and is highly effective.
- RBL: bl.spamcop.net is built from user spam reports and changes quickly.
Spamhaus's free public mirrors are meant for low-volume, non-commercial use and refuse queries that arrive through large public DNS resolvers. A commercial mail server usually needs Spamhaus's registered Data Query Service. If queries are refused, the lookup simply fails and gives no protection, so read each provider's terms and make sure your server uses its own local resolver.
Add a custom RBL
Click Manage Custom RBLs on the RBLs tab and add a list with a name, an information URL and its DNS zone. For example, the Barracuda Reputation Block List:
- Name: Barracuda
- Info URL:
https://barracudacentral.org/ - DNS list:
b.barracudacentral.org
Barracuda requires a free registration of the DNS servers that will query it. After you add a custom RBL, return to the RBLs tab and switch it On; adding it doesn't enable it.
Don't stack many lists. Two or three reputable ones stop most spam; aggressive lists that block whole networks cause false positives. Your own relay hosts and trusted senders can be whitelisted in the same tab.
4. Turn on the HELO checks
When a server connects, it introduces itself with a HELO (or EHLO) name. Spam software often skips this or lies. On the ACL Options tab, turn on:
- Require HELO before MAIL: rejects clients that start sending without introducing themselves.
- Require remote (domain) HELO and Require remote (IP address) HELO: reject clients that claim to be your own server's hostname or IP address, which no real outside server does.
- Require RFC-compliant HELO: rejects obviously invalid names.
These checks rarely affect legitimate mail and remove a lot of low-quality spam cheaply.
5. Set SpamAssassin thresholds
SpamAssassin scores each message; SpamAssassin's own default treats 5 or more as spam. In the ACL Options tab you can set two thresholds that act at SMTP time:
| Setting | What it does | Suggested value |
|---|---|---|
| Apache SpamAssassin reject spam score threshold | Refuses messages scoring at or above this value | 10 to 15 |
| Apache SpamAssassin ratelimit spam score threshold | Rate-limits senders whose messages score at or above this value | 10 to 15 |
A high reject threshold refuses only clear spam. Messages that score between 5 and your threshold are still delivered, and each user's spam filter can mark or move them. Setting the reject threshold near 5 causes false positives.
On the Apache SpamAssassin Options tab, Apache SpamAssassin: Forced Global ON makes SpamAssassin scan mail for every account, and users can't switch scanning off. It adds scanning load, so check the server has CPU to spare.
6. SPF and DKIM on incoming mail
The ACL Options tab also offers options to reject messages that fail SPF, and the Basic Editor can verify DKIM signatures on incoming mail. SPF rejection stops obvious forgeries of domains with strict SPF records, but it also rejects forwarded mail, so turn it on only after checking your users' mail flow. For writing your own rules beyond the Basic Editor, see the Custom Exim ACL guide.
7. Test and monitor
- Send a test spam message containing the standard GTUBE test string from an outside account. It should be refused or marked.
- Check the logs. Rejections are recorded in
/var/log/exim_rejectlogand/var/log/exim_mainlog. Search for the sender or IP when a user reports missing mail:
grep -i "[email protected]" /var/log/exim_rejectlog | tail -20- Simulate a connection with
exim -bh 203.0.113.25to see which rule would reject a given IP address. - Review weekly for the first month. If one RBL causes most of your false positives, turn it off.
No combination of settings stops all spam. RBLs, HELO checks and SpamAssassin together remove most of it at the door and leave the rest to per-user filtering.
8. On Domain India hosting
Shared hosting: the mail server and its spam settings are managed for every account on the server, so you can't open WHM. You can still control spam for your own mailboxes with your panel's spam filter tools. On cPanel, see The SpamAssassin spam box and configure spam filters. If legitimate mail is being rejected, open a support ticket with the sender's address and the time it was sent.
VPS: Domain India VPS plans are self-managed, with root access, and don't include cPanel; the VPS page lists the control panels offered. This guide applies only if you run cPanel & WHM on your own server.
Business Email: if you'd rather not run a mail server at all, Business Email gives you managed mailboxes for your domain. The price on the card is live and excludes 18% GST.
- Priced per mailbox - start with one
- Email at your own domain ([email protected])
- Add and remove mailboxes yourself
- Webmail with calendar, contacts and tasks
Where is Exim Configuration Manager?
It is in WHM, under Service Configuration, and only the server's root administrator can open it. It is not in cPanel, so shared hosting customers can't use it.
Which RBLs should I enable in WHM?
Spamhaus ZEN and SpamCop are the two built-in options and a good start, and Barracuda can be added as a custom RBL after a free registration. Check each list's usage terms: Spamhaus's free service is for low-volume, non-commercial use and refuses queries sent through large public resolvers.
What SpamAssassin reject threshold should I use?
A value between 10 and 15 refuses only clear spam at SMTP time. SpamAssassin's own default treats 5 as spam, so a reject threshold close to 5 blocks legitimate mail. Messages between 5 and your threshold are still delivered and can be filtered per mailbox.
Why was a legitimate email rejected after I enabled RBLs?
The sending server's IP address is probably listed on one of your blocklists. Search /var/log/exim_rejectlog for the sender to see which list matched, ask the sender to have their IP delisted, or whitelist the sending host in the RBLs tab.
Can I change Exim settings on Domain India shared hosting?
No. The mail server on shared hosting is shared by every account, so its settings are managed for you. Use the spam filter tools in your control panel for your own mailboxes, and open a support ticket if legitimate mail is being rejected.
Does Domain India offer cPanel on a VPS?
No. Domain India VPS plans don't include cPanel. The VPS page lists the control panels that are offered, and the VPS is self-managed with root access.
Ready to deal with spam? On shared hosting, open your control panel from your hosting services and set up your spam filters. For managed mailboxes, see Business Email. If mail is being rejected, open a support ticket.
Send us the sender, the recipient and the time of the message so we can look into it.
Ask our support team