How to Prevent Annoying Spam Outbreaks in cPanel and Plesk Servers


We hate spam, you hate spam! We all hate spam! If you are using the cPanel or Plesk control panel, this post goes over a few quick and easy steps that you can take to block annoying spam

Spam is not just annoying, but often a security threat. Cleaning up cluttered mailboxes is time-consuming and messages are often laced with virus attachments or malicious links, leading to e.g. ransomware attacks.

The best webmasters prevent spam, not just clean it up!

Thankfully, this task is made easier with panels – especially cPanel and Plesk.

Each provides a number of useful features to manage unwanted emails. You can significantly reduce spam within minutes.

How to Prevent Spam in cPanel and Plesk

Use SpamAssassin + spam filter

Both cPanel and Plesk have SpamAssassin (SA) preinstalled and integrated into the local mail server. When enabled, SA scans all incoming email and rates them on various factors.

For example, does the email have images and no text?

If the rating exceeds the allowed score, the email is marked as spam or deleted (as based on your preferences).

Both panels also offer other filters, allow you to redirect or even delete emails based on keywords.

For example, the word  “Viagra” in the subject line. These filters, in combination with SpamAssassin detections, create a very powerful anti-spam mechanism on the server.

How to enable SA in cPanel How to enable SA in Plesk
  1. Login to cPanel, go to the mail section.
  2. Click the SpamAssassin icon and then enable it.
  3. Note the options to auto-delete mail, or auto-add a prefix to suspect messages.
  4. Using either the Global Mail Filters or the Mail Filters, add keyword-based filtering as needed.
  1. Login to Plesk
  2. Go to your domain
  3. Go to the Mail tab
  4. Go to the email address that you want to filter
  5. Enable SpamAssassin (and as with cPanel, note the options to mark or delete)
Pro Tip: Use the keywords generated by SpamAssassin and placed in message headers, not just to/from or keywords in subjects!

Enable DKIM and SPF checks

DKIM is the second revision of the DomainKeys authentication system. It checks whether an email is from the domain it claims to have been sent from.

If the message fails this check, it gets rejected by the server as spam.

DKIM is two-way. Any email you send must be signed in order to not be discarded or bounced by another server. And then you can instruct your server to reject or black hole as well.

This process involves many steps, and a great guide for these panels can be found  here. Plesk has a dedicated DKIM selection area, while cPanel leverages DKIM checking via custom SpamAssassin mail filtering rules.

Important Note: Both cPanel and Plesk also use SPF (sender policy framework), which is yet another authentication system for email.

Disable catchall email

The catch-all (or catchall), aka the domain default email account, will accept all messages to non-existent accounts on a server when enabled.

Spammers blast spam to sites, whether or not they know an address.

For example, sales@ is a common spam message sent to all sites. If sales@ does not exist, and a catchall does, it’s diverted to this mailbox. So never enable the catchall address!

Doing so wastes server space, can consume CPU and RAM, and can allow malware onto the system.

While it can be useful for senders who mistyped the email address, it’s not worth it. Either set the address to either blackhole (discard) or reject (bounce) the messages.

To enable in cPanel To enable in Plesk
  1. Login to cPanel
  2. Click the Default Address icon
  3. Discard under the advanced options
  4. Ignore the cPanel warning that it’s not recommended. It most certainly is recommended! Note that bouncing can create a backscatter problem, so blackholing is the best option.
  1. Login to Plesk
  2. Go to your domain
  3. Go to the Mail tab
  4. Click on Mail for Non-Existent Users
  5. Make sure “reject” is enabled by default. (Unfortunately, Plesk does not give the option to blackhole, so reject is next best)

EuroVPS vs. spam

We hate spam, you hate spam! We all hate spam!

Instead of cleaning up spam, and wasting your day, let EuroVPS help you. We’ll setup up your managed shared, VPS or dedicated plan to thwart spam. To learn a little bit more about our relationship with spam, you can read our spam and blacklisting policy in our FAQ section.