If you have enabled SpamAssassin in cPanel but spam still floods your inbox, you are not alone. Proper cPanel SpamAssassin configuration requires more than flipping a single toggle — you need to verify the WHM-level service is running, dial in the right threshold score, activate Spam Box quarantine, and optionally layer on RBL checks and Bayesian learning. This guide walks you through every step so your server stops spam reliably in 2025.
Why SpamAssassin Still Lets Spam Through (and How to Fix It)
Most administrators assume that enabling SpamAssassin inside a cPanel account is sufficient. In reality there are three common reasons spam continues to reach the inbox even after the feature appears active:
- WHM Service Manager has SpamAssassin disabled at the server level — the cPanel toggle becomes meaningless if the underlying
spamddaemon is not running. - The spam threshold score is set too high — cPanel ships with a default score of 5, but many modern spam campaigns score between 5 and 8, slipping right through.
- Spam Box is not configured — without a dedicated spam folder, SpamAssassin tags messages as spam but delivers them to the inbox anyway.
Work through the six steps below in order and you will close all three gaps. If you would rather hand this off to specialists, our managed cPanel server support team handles full SpamAssassin tuning as part of every server management plan.
💡 None of these worked? Skip the guesswork.
Get Expert Help →Step 1: Enable SpamAssassin in WHM Service Manager
Open https://yourserver.com:2087 and authenticate with your root or reseller credentials.
In the WHM left sidebar search for Service Manager or follow the path: Home > Service Configuration > Service Manager.
Locate the row labelled SpamAssassin Mail Filter (spamd). Tick both the Enabled and Monitor checkboxes, then click Save. WHM will start spamd immediately.
systemctl status spamdYou should see active (running). If the service fails to start, check /var/log/messages or run journalctl -u spamd -n 50 for error details.
Log in to the cPanel account, navigate to Email > Spam Filters.
Toggle Process New Emails and Mark them as Spam to On.
Send a test message from an external address and inspect the raw headers. You should see:
X-Spam-Status: No, score=2.4 required=5.0
X-Spam-Checker-Version: SpamAssassin 3.4.6If these headers are absent, the daemon is not processing mail for this account — revisit Step 1.
In cPanel > Email > Spam Filters, toggle Move New Spam to a Separate Folder (Spam Box) to On.
# Purge spam older than 30 days for all accounts
0 3 * * * find /home/*/mail/*/spam/new -mtime +30 -delete
0 3 * * * find /home/*/mail/*/spam/cur -mtime +30 -deleteStep 5: Configure Whitelist and Blacklist Rules
SpamAssassin allows per-user and server-wide whitelist and blacklist entries.
Per-Account Rules (cPanel)
Inside cPanel > Email > Spam Filters, click Show Additional Configurations to access whitelist and blacklist entry fields.
Server-Wide Rules (local.cf)
# Whitelist a trusted sender
whitelist_from support@trustedvendor.com
# Blacklist a known spam domain
blacklist_from *@spammydomain.net
# Whitelist an entire domain
whitelist_from *@yourpartner.comRestart spamd after any changes to local.cf.
Step 6: Advanced Tuning — RBLs and Bayesian Filtering in WHM
Enable RBL Checks
RBLs check the sending IP against known spam databases at the SMTP level. Enable these in WHM > Email > Exim Configuration Manager > ACL Options:
zen.spamhaus.org— covers SBL, XBL, and PBL; the most effective single RBL.bl.spamcop.net— community-sourced spam IP reports.dnsbl.sorbs.net— catches open relays and dynamic IP spam sources.
You can also add RBL scoring in local.cf:
header RCVD_IN_ZEN eval:check_rbl('zen','zen.spamhaus.org.')
score RCVD_IN_ZEN 3.5
header RCVD_IN_SPAMCOP eval:check_rbl('spamcop','bl.spamcop.net.')
score RCVD_IN_SPAMCOP 2.0Enable Bayesian Filtering
use_bayes 1
bayes_auto_learn 1
bayes_auto_learn_threshold_nonspam 0.1
bayes_auto_learn_threshold_spam 12.0Train the Bayes database:
# Train on spam
sa-learn --spam /path/to/spam/maildir
# Train on legitimate mail
sa-learn --ham /path/to/ham/maildir
# Check database stats
sa-learn --dump magicThe Bayes classifier becomes effective after processing roughly 200 spam and 200 ham messages.
Troubleshooting: SpamAssassin Not Working
spamd is not running
systemctl status spamdIf stopped: systemctl start spamd. Common causes include insufficient memory (spamd requires at least 512 MB RAM available).
SpamAssassin headers missing from messages
In WHM go to Exim Configuration Manager > ACL Options and verify Spam Assassin: Exim ACL Spam Scanning is enabled.
Spam scores are all 0.0
Check that spamd is listening on localhost:783:
telnet 127.0.0.1 783A successful connection returns a SPAMD banner.
Rule updates are stale
sa-update --no-gpg
systemctl restart spamdSchedule as a weekly cron:
0 2 * * 0 /usr/bin/sa-update --no-gpg && systemctl restart spamdFalse positives
If legitimate mail is being flagged, raise the threshold slightly (try 4 instead of 3) or whitelist the sending domain. Review the X-Spam-Report header on affected messages and adjust individual rule scores in local.cf:
score MISSING_HEADERS 0.5With all six steps in place — WHM service enabled, threshold tuned, Spam Box active, whitelist/blacklist configured, and RBLs layered on — your cPanel server will catch the vast majority of spam before it reaches any inbox. If your mail environment is complex or you manage dozens of accounts, our team at CloudHouse Technologies provides managed cPanel server support with end-to-end SpamAssassin configuration included.