Base de Conhecimento

Your hosting account runs every incoming message through a spam filter (Apache SpamAssassin) before it reaches your mailbox. This guide shows you how to adjust spam filters in cPanel: how the spam score works, how to move spam to a separate Spam Box folder instead of your inbox, how to make the filter stricter or gentler, and how to use the allow and block lists (called Whitelist and Blacklist in cPanel) so the right senders always get through.

How the spam filter decides what's spam

SpamAssassin doesn't make a yes-or-no guess. It runs dozens of tests on each message -- Is the sender's domain authenticated? Does the message contain phrases common in spam? Is the sending server on a blocklist? Is the HTML badly formed? -- and each test adds or subtracts points. The total is the message's spam score.

You then pick a threshold. Any message that scores at or above the threshold is treated as spam; anything below it is delivered normally. The threshold is the main dial you control:

Change the threshold in small steps -- one point at a time -- and watch the results for a few days before changing it again.

Open the Spam Filters page

1. Log in to cPanel (from the client area: Services > My Services, choose your plan, then Log in to cPanel). See How to Log In to cPanel from the Client Area.
2. Go to Email > Spam Filters. You can also type "spam" into the cPanel search bar.

You'll see a few switches at the top and a section called Additional Configurations (For Advanced Users) further down. Here's what each part does.

Step 1: Make sure spam filtering is on

The first switch, Process New Emails and Mark them as Spam, turns SpamAssassin scoring on or off for your account. It should be on. When it's on, messages that reach your threshold are marked as spam -- depending on the account's configuration, you may see ***SPAM*** at the start of the subject line, and spam headers are added to the message either way.

Marking alone doesn't move anything. A marked message still lands in your inbox unless you also turn on Spam Box (Step 2) or create a filter that acts on it.

Step 2: Turn on Spam Box to keep spam out of your inbox

Spam Box is the safest way to deal with spam. It moves anything that reaches your threshold into a separate folder called spam, so your inbox stays clean but nothing is lost if the filter makes a mistake.

1. On the Spam Filters page, switch Move New Spam to a Separate Folder (Spam Box) on.
2. Open webmail (see How to Log In to Webmail (Roundcube)). A folder named spam appears in the folder list once the first spam message arrives.
3. On a phone or desktop app using IMAP, the folder may not show up until you subscribe to it or refresh the folder list. In most apps, look for a "manage folders" or "subscribe" option in the account settings.

Check the spam folder every few days, especially after you change the threshold. If you use POP3 on a device, remember that POP3 only downloads the inbox -- you'll need to check the spam folder in webmail.

Spam Box messages count toward your mailbox quota. On the Spam Filters page, the Spam Box section has options to empty the spam folder for one account or for all accounts. Clearing it regularly helps avoid "mailbox full" problems (see How to Free Up Mailbox Space with Email Disk Usage).

Step 3: Be careful with Auto-Delete

The third switch, Automatically Delete New Spam (Auto-Delete), permanently deletes any message whose score meets or exceeds a separate Auto-Delete Threshold Score. Deleted messages don't go to the spam folder or the trash, and the sender isn't told. You'll never know they existed.

We recommend leaving Auto-Delete off and using Spam Box instead. If you really want it, set the Auto-Delete threshold much higher than your normal spam threshold -- for example, spam threshold 5 and Auto-Delete at 10 or more -- so only the most blatant junk is destroyed and borderline mail still goes to the spam folder for you to review.

Step 4: Adjust the spam threshold score

1. Scroll to Additional Configurations (For Advanced Users) and click Show Additional Configurations.
2. Click Adjust Spam Threshold Score.
3. Choose a value from the Spam Threshold Score menu, or choose Custom and type a number (decimals such as 4.5 are fine).
4. Click Update Scoring Options (or the save button shown on your screen).

The new threshold applies to messages that arrive after you save. It doesn't re-check mail already in your inbox or spam folder.

How to see a message's actual score

Before changing the threshold, look at the scores your real mail is getting. SpamAssassin adds headers to each message it checks. In Roundcube, open the message, click More (the three dots), and choose the option to view the source or all headers. Look for lines like these:

X-Spam-Status: No, score=2.1
X-Spam-Bar: ++
X-Spam-Flag: YES

The exact headers vary a little, but the score is the number to note. If the spam slipping through scores around 4, and your real mail scores 1 or 2, lowering the threshold from 5 to 4 is a reasonable change. If real mail from one sender keeps scoring 6 or 7, don't raise the threshold for everyone -- add that sender to the allow list instead (Step 5).

Step 5: Always allow a sender (Whitelist)

The allow list tells SpamAssassin that mail from certain senders is never spam, whatever its score. Use it for customers, suppliers, your bank, your accountant, or any automated system whose mail keeps getting caught.

1. Under Additional Configurations, click Edit Spam Whitelist Settings.
2. Click Add A New "whitelist_from" Item.
3. Type the address or pattern (examples below).
4. Repeat for each sender, then click Update Whitelist (whitelist_from) to save.

You can use wildcards: * matches any number of characters and ? matches a single character.

Allow list do's and don'ts

• Do be as specific as you can. One exact address is safer than a whole domain.
• Don't allow huge free-mail domains such as *@gmail.com, *@yahoo.com or *@outlook.com. Spammers use those too, and you'd switch off filtering for all of them.
• Don't allow your own domain (*@example.com). Spammers very often forge your own address in the From line. Allowing your domain lets all of that forged mail straight through.

Step 6: Always block a sender (Blacklist)

The block list works the other way: mail from these senders is always treated as spam. With Spam Box on, it goes to the spam folder.

1. Under Additional Configurations, click Edit Spam Blacklist Settings.
2. Click Add A New "blacklist_from" Item and type the address or pattern, for example *@annoying-marketer.example.
3. Click Update Blacklist (blacklist_from) to save.

The block list only matches the From address, and spammers change addresses constantly, so it works best against persistent legitimate senders who ignore unsubscribe requests. For mail you want deleted or routed somewhere else instead of sent to the spam folder, use an email filter -- see How to Block an Email Sender with a Filter.

Advanced: Configure Calculated Spam Score

Under Additional Configurations there's also Configure Calculated Spam Score, which lets you change the points given by individual SpamAssassin tests (such as BAYES_99 or URIBL_BLACK). You can find the test names in the X-Spam-Status or spam report header of a message. Raising the score of a test that keeps matching spam can help, but it's easy to make things worse. Change one test at a time and write down what you changed so you can undo it.

Spam Filters vs. email filters

A useful combination: keep Spam Box on, and add an email filter that deletes mail whose Spam Status begins with "Yes" and whose Spam Score is very high -- but only once you're confident nothing real reaches those scores.

Troubleshooting

Real email keeps going to the spam folder

1. Open one of the caught messages and check its score and which tests it hit.
2. If it's the same sender every time, add that exact address to the allow list.
3. If many different legitimate senders score just over your threshold, raise the threshold by one point.
4. If the message is from your own website's contact form, the form is probably sending "from" the visitor's address. Fix the form so it sends from an address on your domain -- see Why Your Emails Go to Spam (and How to Fix It).

Lots of spam still reaches my inbox

• Check that Process New Emails and Mark them as Spam and Spam Box are both on.
• Look at the scores on the spam that got through. If they're just under your threshold, lower it by one point.
• If the spam scores 0 or less, check your allow list for an overly broad entry such as your own domain or a free-mail domain.
• If the junk comes from a forwarder or a mailbox at another provider that forwards to you, the filtering is happening (or not) at the other provider.

I can't find the spam folder on my phone

Open the account's folder list or mailbox settings and subscribe to the spam folder, or check it in webmail. POP3 accounts can't see it at all.

I marked something as "Junk" in Roundcube -- where did it go?

Roundcube's Junk button moves the message to your Junk folder. That's separate from the server's spam folder. Either folder is fine for reviewing junk; just check both.

Common questions

Do these settings apply to all my email addresses?

Settings made on the cPanel Spam Filters page apply to the mailboxes on your hosting account. If you need one address to be treated very differently, use an email filter for that account instead.

Is greylisting or BoxTrapper available?

No. Greylisting and BoxTrapper aren't included on standard plans. SpamAssassin with Spam Box, plus email filters, covers what most people need.

Does the spam filter check mail I send?

No. These settings only score incoming mail. If your outgoing mail lands in other people's spam folders, see Why Your Emails Go to Spam (and How to Fix It).

Someone says their email to me bounced as spam

SpamAssassin on your account marks or moves spam; with Auto-Delete off, it doesn't bounce mail back. A bounce usually comes from somewhere else, such as a server-level block or a problem at the sender's end. Ask them to send you the full bounce and see How to Read a Bounce Message (Common Email Errors Explained), or send it to us in a ticket.

Related guides

• How to Create Email Filters for One Account in cPanel
• How to Create Global Email Filters in cPanel
• How to Block an Email Sender with a Filter
• Why Your Emails Go to Spam (and How to Fix It)
• How to Free Up Mailbox Space with Email Disk Usage

Still stuck? Open a support ticket and the Instant Access Internet Services team will help.