How to Prevent Spam on cPanel Servers

A compromised website or email account is the most common reason for spam being sent from cPanel servers. The IP address of a server that sends spam ends up on blacklists, and email from everyone on the server stops being delivered. The WHM settings below both limit spam and make it easier to find its source.

All of these settings are on the Mail tab of WHM > Server Configuration > Tweak Settings.

Sending limits

• Max hourly emails per domain: the maximum number of emails a domain can send per hour (default unlimited). We recommend setting a limit that matches what your websites really need; a compromised account cannot exceed it.
• Maximum percentage of failed or deferred messages a domain may send per hour: the maximum percentage of a domain's messages per hour that may fail or be deferred (default unlimited). Spamming accounts have a high rate of undeliverable mail; this limit stops sending for that domain.
• Number of failed or deferred messages a domain may send before protections can be triggered: the minimum number of failed messages before the protection above can kick in (default 5).

Detecting spammers

• Number of unique recipients per hour to trigger potential spammer notification: if an account sends to more unique recipients than this in an hour, you get a notification (default 500).
• Select the action for the system to take on an email account when it detects a potential spammer: what happens then: take no action, hold outgoing mail (Hold outgoing mail) or reject it (Reject outgoing mail). If you choose to hold, you can review and release legitimate mail later.
• Track email origin via X-Source email headers: adds headers to messages that show the sending script (default on). If spam is sent from a website, these headers tell you which file sent it; keep this on.

Settings that make abuse harder

• Prevent “nobody” from sending mail: stops nobody, the web server's shared user, from sending mail to remote addresses (default on). Keep it on.
• Restrict outgoing SMTP to root, exim, and mailman (FKA SMTP Tweak): stops scripts on the server from bypassing the mail server and connecting to remote SMTP servers directly (default on). Keep it on.
• Initial default/catch-all forwarder destination: what happens, on new accounts, to mail sent to non-existent addresses. With Fail these messages are rejected and the sender is notified; cPanel recommends this if you receive email attacks. The default is System account.

If spam is being sent

1. Find which account is sending the spam from the X-Source headers or from the WHM notification.
2. Change the password of the compromised email account; if the spam comes from a website, clean the malicious file (scan with Maldet) and update the application.
3. Delete the queued spam from the Mail Queue Manager screen in WHM.

At Verinomi, bulk email and spam are not allowed on any of our services; our IP addresses are checked against blacklists every day. If your IP address is on a blacklist, you can open a support ticket from your client area.

The information in this guide is taken from official documentation: cPanel: Tweak Settings – Mail.