cPanel Spam Filters: Set Up Apache SpamAssassin Right

Two tickets look identical on the surface — "I'm getting flooded with spam" and "my newsletter keeps landing in the spam folder" — but they're the same root cause pointing in opposite directions: cPanel's built-in spam filter. Get the settings right once and both problems go away.

Symptom: too much spam, or too many false positives

You'll usually land here for one of two reasons:

• Your inbox is drowning in junk mail even though your host has a clean reputation and MX records are fine.
• A real customer email, a password reset, or your own newsletter gets tagged *****SPAM***** and buried in a Spam folder nobody checks.
• You forwarded mail to Gmail or Outlook and now spam-tagged messages pile up there instead, doubling the mess.

Both cases trace back to the same feature: Apache SpamAssassin, running quietly inside cPanel's Spam Filters tool. Most accounts have it half-configured — enabled, but never tuned — which is exactly how you get both problems at once.

Cause: SpamAssassin is a scoring engine, not an on/off switch

cPanel doesn't just block or allow mail. Every incoming message gets scanned by SpamAssassin and assigned a numeric score based on dozens of checks — sender reputation, broken headers, spammy phrasing, missing SPF/DKIM, link density, and more. That score then gets compared against a threshold you (or your host's default) set:

• Below the threshold — mail is delivered normally.
• Above the threshold — the subject gets rewritten with a spam tag, or the message is routed straight into a Spam folder, depending on your settings.

The default required score in cPanel is usually 5. Set it too low (like 3) and legitimate transactional email starts getting caught. Set it too high (like 10) and obvious junk sails straight into the inbox. Neither is "wrong" — it depends on your mail volume and how tolerant you are of the two failure modes.

Fix 1: Turn on Spam Filters and pick a delivery action

1. Log in to cPanel and open Email > Spam Filters.
2. Toggle Process New Emails and Mark as Spam to On if it isn't already. This is the master switch — without it, nothing below matters.
3. Decide what happens to flagged mail:
   • Auto-Delete Spam — off by default, and we'd leave it off unless you're getting hundreds of obvious spam messages a day. Auto-delete has no undo.
   • Move to a Spam folder (the safer default) — flagged mail lands in a separate IMAP folder you can glance at weekly before anything is lost for good.

If you're not sure which is active, check Spam Filters > Additional Configurations — it shows the current auto-delete and folder-routing state per email account, not just the domain.

Fix 2: Tune the score threshold instead of guessing

Under Additional Configurations, click through to SpamAssassin Configuration (the exact label varies slightly by cPanel theme, sometimes shown as "Configure SpamAssassin"). Two settings matter most:

Don't touch this blind. Pull a few recent spam messages that got through and check their raw headers for X-Spam-Score — that number tells you exactly how far off your current threshold is, instead of you guessing in the dark.

Fix 3: Whitelist and blacklist specific senders

Score-based filtering will never be perfect for every sender. For the recurring cases — a payment gateway that always gets flagged, or a spam source that keeps slipping through — skip the score entirely:

• In Spam Filters, use the Blacklist/Whitelist Manager to add specific addresses or domains.
• A whitelist entry like *@paymentgateway.com bypasses scoring completely for that sender — use it sparingly, since it also skips future spam checks for that domain.
• Blacklist entries work the same way in reverse, forcing a sender straight to spam regardless of score.

This is per-account in cPanel, so a whitelist added on billing@yourdomain.com doesn't apply to support@yourdomain.com — you'll need to repeat it for every mailbox that needs it.

Fixing false positives on your own outgoing mail

If it's your email getting flagged by recipients (not incoming mail getting flagged by you), SpamAssassin on your own server isn't the cause — that only scores mail arriving at your inbox, not mail you send out. That's a DNS authentication problem (SPF/DKIM/DMARC), which is a separate fix. Don't spend time adjusting SpamAssassin thresholds to solve a deliverability issue on the sending side; it won't touch it.

When to turn it off instead

If you've pointed MX records at Google Workspace or Microsoft 365, their own spam filtering already runs before mail ever touches your cPanel mailbox for that flow — running SpamAssassin on top just adds a second, redundant scoring pass and doubles your false-positive risk. In that setup, it's fine to leave Spam Filters off, or set the threshold high (8-10) as a light backstop rather than a primary filter.

Prevention: review it monthly, not never

• Check the Spam folder for real mail at least weekly if auto-delete is off — false positives are silent by design.
• Revisit the score threshold after any spike in either direction; spam patterns shift, and a setting that worked in January can drift by June.
• Keep SPF, DKIM, and DMARC configured on your domain regardless — it improves your own outbound reputation, which indirectly reduces how often other servers bounce or flag your replies.
• Avoid blanket whitelisting entire free-mail domains like *@gmail.com — it defeats the purpose of filtering for the busiest spam source there is.

Quick recap

Enable Spam Filters, route flagged mail to a folder instead of deleting it, tune the score threshold using real X-Spam-Score headers instead of guessing, and use whitelist/blacklist entries for the specific senders that keep tripping the scoring engine either way.