Server Environment

• OS: AlmaLinux 9.x
• Control Panel: WHM/cPanel 134
• Mail Server: Exim
• Spam Protection: SpamAssassin
• Security Suite: Imunify360
• Web Server: Apache/LiteSpeed compatible

PURPOSE OF THIS GUIDE

This guide helps reduce:

• phishing emails
• spoofed emails
• fake retail spam
• rotating junk domains
• bot spam
• unsolicited marketing emails
• forged sender emails

Typical spam examples:

• Costco fake rewards
• Lowes gift card scams
• Omaha Steak offers
• Harbor Freight phishing
• random .bond, .xyz, .help domains

PART 1 — ENABLE GREYLISTING

WHM Location

WHM ? Security Center ? Greylisting

Recommended Settings

Why It Helps

Greylisting temporarily rejects unknown senders.

Legitimate mail servers retry automatically.

Most spam bots never retry.

PART 2 — ENABLE RBL BLACKLISTS

WHM Location

WHM ? Exim Configuration Manager ? Basic Editor

Enable

• Spamhaus ZEN
• SpamCop

Why It Helps

Blocks known spam IP addresses globally before delivery.

PART 3 — ENABLE SMTP VALIDATION

WHM ? Exim Configuration Manager

Search: HELO

Enable:

• Require RFC-compliant HELO

Search: Sender

Enable:

• Sender Verification Callouts
• Reject unknown sender domains

Why It Helps

Blocks:

• fake SMTP senders
• forged domains
• invalid mail hosts

PART 4 — ENABLE SPAMASSASSIN

WHM Location

WHM ? Manage Apache SpamAssassin

Recommended Settings

PART 5 — ENABLE USER SPAM FILTERS

cPanel Location

cPanel ? Email ? Spam Filters

Enable

• Process New Emails and Mark as Spam
• Move New Spam to Spam Box
• Automatically Delete New Spam

Recommended Delete Threshold

8

Score Meaning

PART 6 — GLOBAL EMAIL FILTERS

cPanel Location

cPanel ? Email ? Global Email Filters

Filter 1 — Block Junk Domains

Rule

Any Header ? matches regex

(\.bond|\.help|\.name|\.xyz|\.top|\.click|\.shop)

Action

Discard Message

Purpose

Blocks junk/spam TLD domains commonly used in phishing.

Filter 2 — Block Retail Phishing Spam

Rule

Subject ? matches regex

(costco|omaha|harbor freight|reward points|gift card)

Action

Discard Message

Purpose

Blocks fake retail reward scams.

PART 7 — FUTURE REGEX EXPANSION

Add More Junk TLDs Later

Example:

(\.bond|\.help|\.name|\.xyz|\.top|\.click|\.shop|\.monster|\.cam|\.sbs|\.cfd)

Add More Subject Keywords Later

Example:

(costco|omaha|gift card|bitcoin|crypto|airdrop|reward points)

IMPORTANT FILTER BEST PRACTICES

Use Specific Keywords

GOOD:

• reward points
• harbor freight
• gift card

BAD:

• offer
• payment
• account

Generic keywords may block legitimate emails.

PART 8 — EMAIL AUTHENTICATION

WHM Location

WHM ? Email Deliverability

Ensure ALL Domains Have

• SPF Valid
• DKIM Valid

Why It Helps

Improves:

• email reputation
• inbox delivery
• anti-spoof protection

PART 9 — IMUNIFY360 ROLE

Imunify360 protects:

• firewall security
• intrusion prevention
• malware scanning
• brute-force protection

Note:

Imunify360 alone does NOT replace mail filtering.

Spam protection still mainly depends on:

• Exim
• SpamAssassin
• RBLs
• Greylisting
• Email Filters

PART 10 — MAIL SERVER MAINTENANCE

Weekly Tasks

Check Spam Folder

Review for false positives.

Update Regex Filters

Add newly discovered spam domains or subjects.

Monitor Exim Logs

Useful commands:

tail -f /var/log/exim_mainlog

grep rejected /var/log/exim_mainlog

PART 11 — OPTIONAL ADVANCED PROTECTION

Recommended Additional Security

CSF Firewall

Provides advanced SMTP abuse protection.

Imunify Email (Premium)

Adds:

• AI spam filtering
• phishing protection
• URL reputation scanning
• advanced mail reputation engine

PART 12 — SAFE OPERATING PRACTICES

DO NOT

• block generic words aggressively
• auto-delete below score 8
• disable SPF/DKIM
• whitelist unknown domains blindly

EXPECTED RESULTS

After proper configuration:

• 70–95% spam reduction
• phishing emails heavily reduced
• junk TLD spam blocked
• spoofed emails minimized
• cleaner inbox management

RECOMMENDED FINAL SECURITY STACK

This combination provides strong enterprise-grade anti-spam protection for WHM/cPanel servers.