SpamAssassin is a smart email tool that helps filtering, identifying and flagging potential spam messages by conducting multiple verifications on email headers and content. It assigns each message a numerical score based on the likelihood that it is spam. The higher the score, the greater the probability that the message is unwanted.
When used properly, SpamAssassin can significantly reduce the volume of unsolicited emails that reach your inbox. In cPanel, this system is integrated via the Spam Filters interface, allowing end users to manage filtering behavior with a user-friendly interface, while still enabling advanced configurations.
This guide explains how to enable or disable SpamAssassin, adjust its filtering thresholds, and configure related options both at the user and server levels.
Table of Contents
Accessing Spam Filters in cPanel
To access Spam Filters:
- Log in to your cPanel account.
- Navigate to the Email section.
- Click on Spam Filters.
This interface acts as a frontend for Apache SpamAssassin and provides toggles for activation, spam box redirection, auto-deletion, and scoring thresholds.
Enabling Apache SpamAssassin
When SpamAssassin is enabled, it begins analyzing all new incoming emails to identify messages that match spam-like patterns using heuristic rules, DNS-based blocklists, Bayesian filtering, and header analysis.
To enable SpamAssassin in cPanel:
- In the Spam Filters interface, locate the section titled Process New Emails and Mark them as Spam.
- Click the toggle to enable the filter.
- A confirmation message will appear, indicating that SpamAssassin is now active.
Once active, each incoming message is assigned a spam score. If the score meets or exceeds the set Spam Threshold Score, the message is flagged with spam-related headers such as:
X-Spam-Status: Yes, score=7.3 required=5.0 tests=…, autolearn=disabledThis score allows further processing such as redirection or deletion.
Enabling the Spam Box
By default, spam-tagged messages are still delivered to your inbox unless you configure them to be isolated.
To move spam into a dedicated folder:
- In Spam Filters, enable the Move New Spam to a Separate Folder (Spam Box) toggle.
- This action creates a new IMAP folder named Spam (or junk, depending on your mail client) in each email account.
Messages identified as spam will be routed there, allowing for manual review and recovery of false positives. You may also enable automatic deletion of the contents of this folder using the Email Disk Usage tool in cPanel.
Enabling Auto‑Delete for Spam Messages
This option is best used in environments with aggressive spam patterns where spam messages consistently meet a predictable score.
To activate auto-delete:
- Enable the Automatically Delete New Spam (Auto-Delete) toggle.
- Set an Auto-Delete Threshold Score, which must be higher than your spam threshold score (e.g., 8 or 10).
Warning:
Auto-delete permanently deletes messages that exceed the auto-delete score. This action is irreversible and should be used cautiously, especially if you expect critical business communications.
Adjusting the Spam Threshold Score
The spam threshold score defines how sensitive SpamAssassin is when tagging an email as spam. Lower scores are more aggressive but may cause false positives.
To configure:
- Click on the Spam Threshold Score link under the filter options.
- Choose a value from 1 (very aggressive) to 10 (very lenient).
-
- Recommended value: 5 (default)
- Aggressive filtering: 3 or lower
- Lenient filtering: 7 or higher
- Click Update Scoring Options to apply changes.
SpamAssassin uses this score in combination with rule scores, Bayesian learning, and blocklists to determine whether a message should be tagged as spam.
Advanced Configuration Options
For users with more advanced requirements, cPanel provides options for customizing how SpamAssassin behaves.
To access these options:
Click Show Additional Configurations at the bottom of the Spam Filters page.
You can configure:
- Whitelist (Trusted Senders)
Add trusted email addresses or domains that should never be marked as spam:
*@example.com will match and include anything that precedes @example.com, such as user1@example.com and user2@example.com.
- Blacklist (Blocked Senders)
Add addresses/domains that should always be marked as spam. - Calculated Spam Score Settings
Override specific test scores within SpamAssassin (only available if configured in /etc/mail/spamassassin/local.cf by server admin).
Changes here are stored in user-level config files under
/home/username/.spamassassin/user_prefs (for local installs).
Let’s say you’re receiving too many legitimate emails that are flagged as spam because of the HTML_IMAGE_ONLY_12 rule.
You can reduce its weight by setting it like this:
Or, you want to be stricter with SPF failures:
