To block spam in cPanel, go to Email → Email Filters (or User-Level Filtering) and create rules that move or delete unwanted messages. In under ten minutes you can cut spam to a bare minimum.
If your business inbox is drowning in dubious offers, unsolicited newsletters, and phishing attempts, you're not alone — spam accounts for more than 45 % of all global email traffic. The good news is that cPanel includes powerful built-in tools to fight back without paying for extra software.
cPanel's Two Anti-Spam Layers
cPanel provides protection at two levels that work together:
- SpamAssassin — an automatic analysis engine that scores every incoming message. High-scoring messages are flagged or deleted automatically.
- Email Filters — manual rules you define based on sender, subject, headers, or body content.
Enabling both layers is the most effective strategy.
Step 1: Enable SpamAssassin
SpamAssassin is your first shield. To turn it on:
- Log in to cPanel and locate the Email section.
- Click Apache SpamAssassin™.
- Click Enable Apache SpamAssassin™ if it shows as inactive.
- Check Automatically move spam to the Spam folder so you can review flagged messages before deleting them.
The default threshold is 5 points. Lower it to 3 if you receive heavy spam volume, or raise it to 7 if you're seeing too many false positives. Start at 5 and adjust from there.
SpamAssassin Blocklist and Allowlist
On the same screen you'll find two important lists:
- Blocklist — addresses or domains that will always be marked as spam.
- Allowlist — trusted senders that will never be flagged, regardless of their score.
Add suspicious domains like *@sketchydomain.com to your blocklist, and add your key suppliers or clients to the allowlist.
Step 2: Create User-Level Email Filters
Email filters let you write precise rules for individual accounts — handy when SpamAssassin misses certain message patterns.
- In cPanel, go to Email → User Level Filtering.
- Select the email account you want to protect.
- Click Manage Filters, then Create New Filter.
Each filter has two parts: the conditions (what to look for) and the actions (what to do with the message).
Most Useful Conditions
- Subject contains — block keywords like "you've won", "quick loan", or "URGENT".
- From contains — block a specific sender or an entire domain.
- X-Spam-Score header is greater than — pair with SpamAssassin for a custom action.
- Body contains — useful for recurring phishing phrases.
Recommended Actions
| Action | When to Use It |
|---|---|
| Move to folder | When you want to review messages before deleting them (recommended) |
| Discard message | For known senders you never want to deal with |
| Fail with error code | To reject at server level without accepting the message |
| Redirect to | To forward a certain type of message to another address |
Step 3: Global Filters for the Entire Domain
If you manage multiple email accounts under the same domain, global filters apply rules to every account at once.
- In cPanel, find Email Filters (without "User Level").
- Click Manage Filters.
- Create the rule the same way as above; it will apply to any account on the domain.
This is ideal for blocking mass spam campaigns that hit your entire team simultaneously. To make sure your setup is solid from day one, professional email hosting from elenlace.com includes expert guidance so you're never left configuring these rules alone.
Step 4: Verify That SPF, DKIM, and DMARC Are Active
cPanel filters stop incoming spam, but DNS records protect your sending reputation and reduce spoofed outbound spam using your domain.
- SPF — declares which servers are authorized to send email on behalf of your domain.
- DKIM — a cryptographic signature that verifies messages weren't altered in transit.
- DMARC — a policy that tells receiving servers what to do when SPF or DKIM fail.
In cPanel, go to Email → Email Deliverability to check the status of these records and enable them with a single click if they're inactive. Browse more email setup guides in our business email section.
Key Takeaways
- Enable SpamAssassin as your automatic first line of defense and tune the threshold to minimize false positives.
- Use allowlists and blocklists to refine SpamAssassin results for known senders.
- Build user-level filters to catch specific patterns the automatic engine misses.
- Apply global filters when a spam campaign hits all accounts on your domain.
- Confirm that SPF, DKIM, and DMARC are active to protect your sender reputation as well.
- Prefer move to folder over delete until you're confident there are no false positives.
If you'd rather have experts handle the setup from the start, get your professional email at elenlace.com and we'll help you keep spam under control — no technical headaches required.
FAQ
Do cPanel filters work with Outlook, or only in webmail?
Filters work at the server level, before any message reaches a client. It doesn't matter whether you use Outlook, Thunderbird, a Gmail account connected via IMAP, or Roundcube webmail — the filter acts before delivery.
What do I do if a legitimate email lands in the spam folder?
Move it to your inbox and add the sender to SpamAssassin's allowlist. If the culprit is a manual filter you created, edit or delete that rule under User Level Filtering.
Can I block emails by country or language?
cPanel doesn't include native geo-blocking, but you can build a header-based filter that checks the Content-Language field or the sender's TLD. For advanced geographic blocking, a dedicated email firewall is recommended.
How often should I check the spam folder?
For the first two weeks after enabling your filters, check every day or two to catch false positives. Once your rules are dialed in, a weekly review is plenty.
Further reading
Other providers and guides worth comparing:
