cPanel gives you two separate systems for controlling what reaches your inbox. Spam Filters uses Apache SpamAssassin to score incoming mail and act on what looks like spam. Email Filters are rules you write yourself to sort, file, forward or discard messages. They work together, and this guide covers both - plus what to do when the filter catches the wrong thing.
- Apache SpamAssassin is enabled and marks suspicious mail. Fast Hive enables this by default and it cannot be turned off - it protects every mailbox on the server.
- Spam Box is enabled, so flagged mail goes to a separate Spam folder rather than your inbox.
- Auto-Delete is disabled by default, which is the safe setting.
- The Spam Threshold Score is 5. Mail scoring 5 or above is treated as spam.
How the spam score works
SpamAssassin examines each message against hundreds of tests - suspicious phrasing, forged headers, missing authentication, known bad senders - and adds up a score. The higher the score, the more spam-like the message.
| Threshold | Effect |
|---|---|
| 1–3 | Very aggressive. Will catch legitimate mail. Not recommended. |
| 5 | The default, and a well-tested balance. Start here. |
| 7–10 | Permissive. Fewer false positives, more spam in the inbox. |
Adjust the threshold in Email → Spam Filters under Show Additional Configurations. Move it one point at a time and live with it for a week before deciding.
Spam Box versus Auto-Delete
Spam Box moves flagged mail to a Spam folder you can review. Auto-Delete discards it permanently at delivery - no bounce, no copy, no way to recover it.
Reviewing and emptying the Spam folder
The Spam folder is a real folder, visible in webmail and in any mail client connected over IMAP. Check it weekly, and remember it counts against your mailbox quota - empty it periodically or it will eventually fill your account.
Additional configurations
Under Show Additional Configurations in Spam Filters you will find:
- Whitelist (allow list) - senders never treated as spam. Add addresses whose mail has been wrongly filtered.
- Blacklist (block list) - senders always treated as spam.
- Spam Threshold Score - as described above.
Use wildcards for a whole domain, for example *@importantclient.com. Whitelist deliberately and sparingly - whitelisting your own domain is a common mistake, because spammers forge your domain as the sender, and you would be waving that straight through.
Email Filters: your own rules
Filters run on delivery and act on whatever you tell them to. There are two kinds:
- Email → Email Filters - rules for one specific mailbox.
- Email → Global Email Filters - rules applied to every mailbox on the account.
Creating a filter
- Open Email → Email Filters and click Manage Filters beside the mailbox (or open Global Email Filters).
- Click Create a New Filter and give it a descriptive name.
- Set the Rules - choose the part of the message to examine (From, Subject, To, Body, Any Header, Spam Score and others), the comparison (contains, matches, begins with), and the value.
- Add further rules with and / or if needed.
- Choose the Actions: deliver to a folder, redirect to another address, discard, fail with a message, stop processing further rules, or pipe to a program.
- Click Create.
Useful recipes
| Goal | Rule | Action |
|---|---|---|
| File form submissions away from the inbox | Subject contains Website enquiry |
Deliver to folder INBOX.Enquiries |
| Send invoices to the accountant too | Subject contains Invoice |
Redirect to their address |
| Catch anything very obviously spam | Spam Score is greater than 10 |
Deliver to folder INBOX.Junk |
| Stop one persistent sender | From contains their address | Discard message |
| Keep automated alerts out of the way | From contains noreply@ |
Deliver to folder INBOX.Alerts |
Track Delivery
Email → Track Delivery shows what actually happened to a message: delivered, deferred, rejected, or filtered - with the reason. When someone says "I sent you an email and you never replied", this is the tool that answers it definitively, and it is far more reliable than guessing.
Troubleshooting
| Symptom | Cause and fix |
|---|---|
| Legitimate mail is going to Spam | Add the sender to the whitelist, and consider raising the threshold from 5 to 6 or 7. Check Track Delivery to confirm the score it received. |
| Expected mail never arrived at all | Check Track Delivery first. If a filter discarded it, the rule is too broad. If it never reached the server, the problem is on the sending side or in DNS. |
| Too much spam still reaching the inbox | Lower the threshold one point at a time. Also stop using a catch-all address if you have one - catch-alls attract enormous volumes of spam. |
| Filter does not match anything | Rules are usually case sensitive and match exactly. Use contains rather than equals, and test with the Filter Test box. |
| A filter is deleting mail you wanted | Discarded mail is gone permanently. Change the action to deliver to a folder instead, so mistakes stay recoverable. |
| Spam folder is huge | It counts against your quota. Empty it, and check Email Disk Usage for the account's overall picture. |
| Spam appearing to come from your own address | Sender forgery, not a compromise in itself. Publish SPF, DKIM and DMARC records - that is what stops others forging your domain. |
| Sudden flood of bounce messages | A mailbox password may be compromised and sending spam. Change all mail passwords and open a ticket immediately. |
Frequently asked questions
Can I turn spam filtering off completely?
No. Fast Hive enables SpamAssassin by default and it cannot be disabled - it protects the whole server's mail reputation, which benefits every customer. You can adjust the threshold and whitelist specific senders.
Does filtering delete my mail?
Not with the default settings. Spam Box moves it to a folder you can review. Only Auto-Delete or a filter with a discard action destroys mail, and both are choices you have to make deliberately.
Should I use cPanel filters or my mail client's rules?
cPanel filters run on the server, so they apply before mail reaches any device and work identically everywhere. Client-side rules only run when that application is open. Use server-side filters for anything that matters.
What is the difference between Email Filters and Global Email Filters?
Email Filters apply to one mailbox; Global Email Filters apply to every mailbox on the account. Use global rules sparingly - a mistake there affects everyone.
Why does my own mail get marked as spam by other providers?
That is a separate issue from inbound filtering - it means your domain is not properly authenticated. See the article on SPF, DKIM and DMARC.
Does the Spam folder count towards my disk quota?
Yes. Spam accumulates quickly, so empty it periodically or a full mailbox will start rejecting new mail.
