This guide helps protect WHM/cPanel mail servers from:

• phishing emails
• spoofed emails
• Bitcoin extortion spam
• fake retail reward scams
• unsolicited marketing emails
• rotating junk domains
• forged sender emails
• SMTP abuse
• spam bot attacks

PART 1 — ENABLE GREYLISTING

WHM Location

WHM ? Security Center ? Greylisting

Recommended Settings

Why It Helps

Greylisting temporarily rejects unknown senders.

Legitimate mail servers retry automatically.

Most spam bots do not retry.

PART 2 — ENABLE RBL BLACKLISTS

WHM Location

WHM ? Exim Configuration Manager ? Basic Editor

Enable

• Spamhaus ZEN
• SpamCop

Why It Helps

Blocks known spam IP addresses before delivery.

PART 3 — ENABLE SMTP VALIDATION

WHM ? Exim Configuration Manager

Search: HELO

Enable:

• Require RFC-compliant HELO

Search: Sender

Enable:

• Sender Verification Callouts
• Reject unknown sender domains

Why It Helps

Blocks:

• forged SMTP servers
• invalid sender domains
• spoofed mail hosts

PART 4 — ENABLE SPAMASSASSIN

WHM Location

WHM ? Manage Apache SpamAssassin

Recommended Settings

PART 5 — ENABLE USER SPAM FILTERS

cPanel Location

cPanel ? Email ? Spam Filters

Enable

• Process New Emails and Mark as Spam
• Move New Spam to Spam Box
• Automatically Delete New Spam

Recommended Delete Threshold

8

Spam Score Meaning

PART 6 — GLOBAL EMAIL FILTERS

cPanel Location

cPanel ? Email ? Global Email Filters

Filter 1 — Block Junk Domains

Rule

Any Header ? matches regex

(\.bond|\.help|\.name|\.xyz|\.top|\.click|\.shop)

Action

Discard Message

Purpose

Blocks junk/spam TLD domains commonly used in phishing attacks.

Filter 2 — Block Retail Phishing Spam

Rule

Subject ? matches regex

(costco|omaha|harbor freight|reward points|gift card)

Action

Discard Message

Purpose

Blocks fake retail reward and gift card scams.

Filter 3 — Block Self Spoofing

Rule Logic

Condition 1

From contains:

yourdomain.com

Condition 2

Any Header does not contain:

YOUR_SERVER_IP

Action

Discard Message

Purpose

Blocks spoofed emails pretending to originate from your own domain.

PART 7 — REMOVE WHITELIST ENTRIES

cPanel Location

cPanel ? Spam Filters ? Show Additional Configurations

Remove Entries Like

whitelist_from *@yourdomain.com
welcomelist_from *@yourdomain.com

Why It Matters

Whitelisted domains bypass spam filtering.

Spoofers abuse this heavily.

PART 8 — SPF CONFIGURATION

Recommended SPF Record

DNS TXT Record:

v=spf1 a mx ip4:YOUR_SERVER_IP -all

Important

Use:

-all

instead of:

~all

for stricter spoof protection.

PART 9 — DMARC CONFIGURATION

DNS Record

Host:

_dmarc

TXT Value:

v=DMARC1; p=reject; adkim=s; aspf=s;

Why DMARC Is Critical

DMARC instructs recipient servers to reject fake emails pretending to come from your domain.

This is one of the strongest anti-spoof protections available.

PART 10 — DKIM VALIDATION

WHM Location

WHM ? Email Deliverability

Ensure:

• SPF = Valid
• DKIM = Valid

for all hosted domains.

PART 11 — CHECK EXIM MAIL QUEUE

SSH Commands

Check mail queue:

exim -bp

Check active SMTP logins:

grep "A=dovecot_login" /var/log/exim_mainlog | tail -50

Check rejected messages:

grep rejected /var/log/exim_mainlog

Monitor live mail logs:

tail -f /var/log/exim_mainlog

PART 12 — IDENTIFYING SPOOFED EMAILS

Common Signs

• From address equals your own email
• External sending IPs in headers
• SPF failures
• DMARC warnings
• Bitcoin extortion subjects
• Random relay servers

Example Spam Subjects

• YOU PERVERT! I RECORDED YOU!
• Your device was infected
• Bitcoin payment required
• Reward points expired
• Gift card available

PART 13 — BITCOIN EXTORTION EMAILS

These are usually fake mass-spam campaigns.

Common characteristics:

• spoofed sender address
• fear-based messaging
• fake hacking claims
• Bitcoin wallet demand
• no actual compromise

Most are harmless spam attempts.

PART 14 — IMUNIFY360 ROLE

Imunify360 helps with:

• firewall protection
• malware scanning
• intrusion prevention
• brute-force protection

Important:

Imunify360 alone does NOT replace proper mail filtering.

Spam protection still mainly relies on:

• Exim
• SpamAssassin
• SPF
• DKIM
• DMARC
• RBLs
• Email Filters

PART 15 — FUTURE FILTER EXPANSION

Add More Junk TLDs Later

Example:

(\.bond|\.help|\.xyz|\.monster|\.cam|\.sbs|\.cfd)

Add More Subject Keywords Later

Example:

(costco|gift card|crypto|bitcoin|reward points)

IMPORTANT FILTER BEST PRACTICES

Use Specific Keywords

GOOD:

• reward points
• harbor freight
• gift card
• bitcoin extortion

BAD:

• payment
• account
• offer
• urgent

Overly generic keywords may block legitimate emails.

PART 16 — WEEKLY MAINTENANCE TASKS

Recommended Weekly Tasks

• review spam folder
• monitor Exim logs
• update regex filters
• check mail queue
• verify SPF/DKIM/DMARC
• scan websites with Imunify360

PART 17 — OPTIONAL ADVANCED PROTECTION

Recommended Additional Security

ConfigServer Firewall (CSF)

Provides advanced SMTP abuse and connection protection.

Imunify Email (Premium)

Adds:

• AI spam filtering
• phishing detection
• URL reputation analysis
• advanced mail reputation engine

EXPECTED RESULTS

After proper configuration:

• 70–95% spam reduction
• phishing heavily reduced
• spoofed emails minimized
• junk TLD spam blocked
• cleaner inbox management

RECOMMENDED FINAL SECURITY STACK

This configuration provides strong enterprise-grade anti-spam protection for WHM/cPanel mail servers.