Introduction

This document provides the recommended Exim configuration for production cPanel/WHM servers used for Shared Hosting, Reseller Hosting, VPS Hosting and Business Email Hosting.

The primary objectives are:

  • Reduce incoming spam.
  • Minimize false positive email filtering.
  • Improve email deliverability.
  • Maintain compatibility with Gmail, Microsoft 365, Outlook, CCAvenue, Banks, IRCTC and Government portals.
  • Provide a stable production configuration suitable for commercial hosting providers.
Note

These recommendations are based on production experience operating commercial hosting servers. Always test configuration changes before deploying them to all customers.

1. Apache SpamAssassin Configuration

Setting Recommended Value
Enable SpamAssassin Yes
Spam Threshold Score 7
Automatically Delete Spam No
Move Spam to Spam Folder Yes

 

Why use Spam Score 7?

The default SpamAssassin score of 5 is often too aggressive for business hosting environments. Legitimate emails from clients, suppliers and automated business systems may be incorrectly classified as spam.

A threshold of 7 provides a better balance between spam filtering and legitimate email delivery.

Recommendation
  • Never automatically delete spam messages.
  • Move spam to the Spam folder instead.
  • Allow users to review messages before permanent deletion.

2. Greylisting Configuration

Recommended Configuration

Preferred Option

Disable Greylisting

Modern email providers such as Gmail, Microsoft 365, Outlook, Zoho and Amazon SES use multiple outbound mail servers. Greylisting may delay or occasionally prevent legitimate email delivery.

If Greylisting Must Be Enabled

Setting Recommended Value
Initial Deferral Period 1 Minute
Resend Acceptance Period 60 Minutes
Record Expiration Time 1440 Minutes (24 Hours)

 

Enable the following option:

Bypass Greylisting for Hosts with Valid SPF Records
Why?

Legitimate mail providers publish valid SPF records. Enabling SPF bypass significantly reduces delays for trusted senders while still slowing many spam bots.

Important

If customers report delayed emails from Gmail, Microsoft 365 or Outlook, Greylisting should be the first feature to review. In many commercial hosting environments, disabling Greylisting entirely provides better results.

End of Part 1
Continue by appending Part 2 directly below this section.

3. Sender Verification Callouts

Sender Verification Callouts perform an SMTP callback to verify whether the sender's email address actually exists. Although this appears to improve spam protection, many legitimate mail providers intentionally reject these verification requests.

Setting Recommended Value
Sender Verification Callouts OFF

 

Important

Enabling Sender Verification Callouts can cause legitimate emails to be rejected before they are accepted by Exim. This is one of the most common reasons for missing transactional and business emails.

Common Services Affected

  • CCAvenue
  • IRCTC
  • Government Portals
  • Banks
  • Amazon SES
  • Microsoft 365
  • Mailchimp
  • SendGrid
  • Payment Gateways

Typical Exim Log Entry

Sender verify failed
Rejected RCPT
550 5.7.1 NULL Sender may not send mail
Production Recommendation

Disable Sender Verification Callouts on production hosting servers. SpamAssassin, SPF, DKIM, DMARC and RBLs provide much more reliable spam protection without rejecting legitimate business email.

4. ACL (Access Control List) Recommended Configuration

ACL rules control how Exim processes incoming SMTP connections before accepting email. The following settings provide a good balance between security and compatibility.

Setting Recommended Reason
Dictionary Attack Protection ON Protects against SMTP brute-force attacks.
Reject Remote Mail Sent to Server Hostname ON Prevents abuse using the server hostname.
Enable SpamAssassin for Secondary MX Domains OFF Only required if acting as a backup MX server.
Ratelimit Suspicious SMTP Servers ON Helps reduce spam floods.
Ratelimit Incoming Connections with Failed Recipients ON Protects against directory harvesting attacks.
Require HELO Before MAIL ON Rejects poorly configured SMTP clients.
Introduce SMTP Delay ON Slows automated spambots without affecting normal users.
Do Not Delay Trusted Hosts ON Improves delivery from trusted systems.
Do Not Delay Common Mail Providers ON Avoids delays for Gmail, Outlook, Yahoo and Microsoft 365.
Require Remote Hostname/IP HELO ON Improves SMTP validation.
Require Remote Domain HELO OFF Many legitimate mail servers do not provide a fully qualified domain.
Require RFC-Compliant HELO ON Rejects invalid SMTP implementations.
Allow DKIM Verification ON Always verify DKIM signatures.
Reject DKIM Failures OFF Forwarding and mailing lists may legitimately break DKIM signatures.

 

Best Practice
  • Enable SPF verification.
  • Enable DKIM verification.
  • Enable DMARC for hosted domains.
  • Do not reject mail solely because of DKIM failures.
  • Avoid aggressive SMTP callback verification.
Administrator Note

For commercial shared hosting servers, email deliverability is generally more important than aggressive filtering. It is preferable to quarantine suspicious messages than to reject legitimate business email during the SMTP transaction.

End of Part 2
Continue with Part 3 - RBL Configuration, Security Settings, DNS Requirements and Monitoring Commands.

5. RBL (Realtime Blackhole List) Configuration

Realtime Blackhole Lists (RBLs) identify known spam sources before messages are accepted by Exim. Using too many RBLs may increase false positives, therefore only trusted RBL providers should be enabled.

RBL Provider Recommended Comments
Spamhaus (zen.spamhaus.org) ON Highly recommended. One of the most accurate and trusted RBL providers.
SpamCop (bl.spamcop.net) ON Recommended as a secondary RBL.
Barracuda OFF May generate false positives. Enable only if specifically required.
SORBS OFF Not recommended due to historical false positive issues.

 

Additional RBL Settings

Setting Recommended
Exempt Servers in Same Netblock ON
Exempt Common Mail Providers ON
Exempt Trusted Hosts ON
Best Practice

Avoid enabling multiple RBL providers unnecessarily. Spamhaus and SpamCop provide an excellent balance between spam protection and legitimate email delivery.

6. Security Configuration

The Security section controls TLS encryption and SMTP authentication security. The following settings are recommended for production servers.

Setting Recommended
Allow Weak SSL/TLS Ciphers OFF
Require SSL/STARTTLS before Authentication ON
Disable SSLv2 Yes
Disable SSLv3 Yes
Disable TLS 1.0 Yes
Disable TLS 1.1 Yes
SSL/TLS Cipher List Default cPanel Cipher List
Recommendation

Do not modify the default cipher list unless specifically required. The default cPanel configuration is regularly updated for security and compatibility.

7. DNS Requirements

Proper DNS configuration is essential for successful email delivery. Every hosted domain should have the following DNS records configured correctly.

DNS Record Purpose
SPF Authorizes mail servers allowed to send email for the domain.
DKIM Cryptographically signs outgoing email.
DMARC Defines policy for SPF and DKIM failures.
MX Specifies the mail server responsible for receiving email.
PTR (Reverse DNS) Maps server IP address back to the hostname.

Recommended DMARC Record

v=DMARC1; p=quarantine; rua=mailto:postmaster@example.com

Reverse DNS

The server hostname should resolve correctly in both directions.

Hostname  ? Server IP
Server IP ? Hostname
Important

Forward DNS and Reverse DNS should always match. Incorrect PTR records significantly increase the likelihood of email being marked as spam.

8. Monitoring and Troubleshooting Commands

View Live Mail Log

tail -f /var/log/exim_mainlog

Search Exim Log

grep -i sender@example.com /var/log/exim_mainlog

View Mail Queue

exim -bp

Count Mail Queue

exim -bpc

Restart Exim

/scripts/restartsrv_exim

Restart SpamAssassin

/scripts/restartsrv_spamd

Restart cPHulk

/scripts/restartsrv_cphulkd
Administrator Tip

Whenever users report missing emails, always check the Exim log before making configuration changes. The mail log usually identifies the exact reason why a message was accepted, rejected or deferred.

End of Part 3
Continue with Part 4 - Production Configuration Summary, Common Issues and Best Practices.

9. Recommended Production Configuration Summary

The following table provides a quick reference for the recommended Exim configuration on production cPanel/WHM servers.

Component Recommended Comments
SpamAssassin Enabled Primary spam filtering engine.
Spam Threshold 7 Provides a good balance between spam filtering and legitimate email delivery.
Automatically Delete Spam No Never delete spam automatically.
Move Spam to Spam Folder Yes Allows users to review false positives.
Greylisting Disabled Recommended for modern mail providers.
Sender Verification Callouts Disabled Prevents rejection of legitimate business emails.
Spamhaus RBL Enabled Recommended.
SpamCop RBL Enabled Recommended.
Barracuda RBL Disabled Optional.
SORBS RBL Disabled Not recommended.
Allow DKIM Verification Enabled Recommended.
Reject DKIM Failures Disabled Avoid false positives.
Require HELO Before MAIL Enabled Recommended.
Require RFC-Compliant HELO Enabled Recommended.
Require STARTTLS before Authentication Enabled Recommended.
Allow Weak TLS Ciphers Disabled Recommended.

10. Common Email Problems and Solutions

Problem Likely Cause Recommended Solution
CCAvenue emails are not received. Sender Verification Callouts enabled. Disable Sender Verification Callouts.
IRCTC emails are not received. SMTP callback verification or sender policy. Review Exim logs and disable Sender Verification if required.
Bank emails missing. SMTP callback verification. Disable Sender Verification Callouts.
Legitimate emails delivered to Spam folder. SpamAssassin score too low. Increase Spam Threshold to 7.
Large amount of spam reaching Inbox. Weak filtering configuration. Verify SpamAssassin, RBLs, SPF, DKIM and DMARC.
Gmail or Outlook emails delayed. Greylisting enabled. Disable Greylisting or enable SPF bypass.
Outgoing mail rejected. Missing PTR, SPF or DKIM. Verify DNS records.

11. Monthly Maintenance Checklist

Review the following items at least once every month.

  • Review Exim mail queue.
  • Check Exim logs for repeated delivery failures.
  • Verify SpamAssassin is running.
  • Confirm Spamhaus and SpamCop are operational.
  • Review mail queue size.
  • Check server IP reputation.
  • Verify Reverse DNS (PTR).
  • Confirm SPF records for hosted domains.
  • Confirm DKIM signing is working.
  • Verify DMARC policies.
  • Review failed authentication attempts.
  • Install latest cPanel updates.
  • Apply Exim security updates.

12. Best Practices

  • Never automatically delete spam.
  • Keep SpamAssassin Threshold at 7 unless business requirements differ.
  • Avoid enabling aggressive RBL providers.
  • Always monitor Exim logs before changing configuration.
  • Use SPF, DKIM and DMARC on every hosted domain.
  • Maintain correct Reverse DNS (PTR).
  • Keep Exim and cPanel fully updated.
  • Monitor server IP reputation regularly.
  • Review mail queue every week.
  • Maintain regular server backups before configuration changes.

Conclusion

This configuration has been prepared for commercial shared hosting servers where reliable email delivery is more important than aggressive filtering.

Combining SpamAssassin, SPF, DKIM, DMARC, trusted RBL providers and proper DNS configuration provides excellent spam protection while maintaining compatibility with modern email providers, banks, government services and payment gateways.

Configuration should always be reviewed after major cPanel or Exim upgrades to ensure continued compatibility and optimal performance.

Was this answer helpful? 0 Users Found This Useful (0 Votes)

Most Popular Articles

Complete WHM/cPanel Anti-Spam & Email Security Configuration Guide

Server Environment OS: AlmaLinux 9.x Control Panel: WHM/cPanel 134 Mail Server: Exim Spam...
Protect WHM/cPanel mail servers

This guide helps protect WHM/cPanel mail servers from: phishing emails spoofed emails...