Recommended cPanel config
For all cPanel systems we recommend the following config:
- Ensure your server hostname resolves and has a reverse dns record
- Use WHM -> Email deliverability to ensure your hostname has both an SPF and DKIM key set up. cPanel will also confirm proper RDNS.
In WHM -> Home -> Service Configuration -> Exim Configuration Manager
- Use the reverse DNS entry for the mail HELO/EHLO if available – Set to OFF
- SPF include hosts for all domains on this system – Set to relay.mailbaby.net
- Enable Sender Rewriting Scheme (SRS) Support – Set to ON
Optional Config
cPanel includes its own anti spam features for outbound. We recommend setting:
- Scan messages for malware from authenticated senders (exiscan)
- Scan outgoing messages for malware
- Scan outgoing messages for spam and reject based on defined Apache SpamAssassin™ score
- Do not forward mail to external recipients based on the defined Apache SpamAssassin™ score (Minimum: 0.1; Maximum: 99.9)
And limiting emails per hour in WHM -> tweak settings.
Having these settings will prevent easily detectable spam from leaving your systems and help reduce the amount of emails sent.
Option 1: Manual editing through Web Host Manager
In Web Host Manager go to Home »Service Configuration »Exim Configuration Manager
Click Advanced Editor
Find Section: AUTH and add
mailbaby_login: driver = plaintext public_name = LOGIN client_send = : $YOURUSERNAME : $YOURPASSWORD
Find Section: POSTMAILCOUNT
remoteserver_route: driver = manualroute transport = mailbaby_smtp domains = !+local_domains ignore_target_hosts = 127.0.0.0/8 route_list = * relay.mailbaby.net::25 randomize byname host_find_failed = defer no_more
Find Section: TRANSPORTSTART
IMPORTANT: ensure X-AuthUser is kept. Failure to do so will result in stricter email filtering
mailbaby_smtp:
driver = smtp
hosts_require_auth = *
tls_tempfail_tryclear = true
headers_add = X-AuthUser: ${if match {$authenticated_id}{.*@.*} {$authenticated_id} {${if match {$authenticated_id}{.+} {[email protected]$primary_hostname}{$authenticated_id}}}}
dkim_domain = $sender_address_domain
dkim_selector = default
dkim_canon = relaxed
dkim_private_key = "/var/cpanel/domain_keys/private/${dkim_domain}"
Optional
Find Section: RETRYSTART
* data_4xx F,4h,1m * rcpt_4xx F,4h,1m * timeout F,4h,1m * refused F,1h,5m * lost_connection F,1h,1m * * F,6h,5m
Find Section: RETRYBLOCK
+secondarymx * F,4h,5m; G,16h,1h,1.5; F,4d,8h * * F,2h,15m; G,16h,1h,1.5; F,4d,8h * auth_failed
Option 2: Create /etc/exim.conf.local
Edit /etc/exim.conf.local – if it exists already you will want to merge the config
%RETRYBLOCK% +secondarymx * F,4h,5m; G,16h,1h,1.5; F,4d,8h * * F,2h,15m; G,16h,1h,1.5; F,4d,8h * auth_failed @[email protected] mailbaby_login: driver = plaintext public_name = LOGIN client_send = : $YOURUSERNAME : $YOURPASSWORD @[email protected] @[email protected] chunking_advertise_hosts = "" local_from_check = true # mailbaby max size limit is 100MB while the cpanel default may be less#message_size_limit = 100M ignore_bounce_errors_after = 1h timeout_frozen_after = 12h @[email protected] @[email protected] @[email protected] @[email protected] @[email protected] remoteserver_route: driver = manualroute transport = mailbaby_smtp domains = !+local_domains #uncomment to exclude specific emails or domains #senders = : [email protected] : !*@domain1.com ignore_target_hosts = 127.0.0.0/8 route_list = * relay.mailbaby.net::25 randomize byname host_find_failed = defer no_more @[email protected] @[email protected] @[email protected] @[email protected] @[email protected] @[email protected] @[email protected] @[email protected] @[email protected] @[email protected] * data_4xx F,4h,1m * rcpt_4xx F,4h,1m * timeout F,4h,1m * refused F,1h,5m * lost_connection F,1h,1m * * F,6h,5m @[email protected] @[email protected] @[email protected] @[email protected] @[email protected] @[email protected] @[email protected] mailbaby_smtp: driver = smtp hosts_require_auth = * tls_tempfail_tryclear = true headers_add = X-AuthUser: ${if match {$authenticated_id}{.*@.*} {$authenticated_id} {${if match {$authenticated_id}{.+} {[email protected]$primary_hostname}{$authenticated_id}}}} dkim_domain = $sender_address_domain dkim_selector = default dkim_canon = relaxed dkim_private_key = "/var/cpanel/domain_keys/private/${dkim_domain}"
When done run
/scripts/buildeximconf
Advanced Config in cPanel
Most advanced config occurs in POSTMAILCOUNT. Important – use postmailcount in order to be able to limit emails per hour with in cpanel.
-
Exclude a domain from MailBaby in exim
Add to remoteserver route a senders section like
senders = : [email protected] : !*@domain2.com
* is a wild card match so *@domain1.com covers [email protected] and [email protected] covers just that sender. Note the ! needed.
remoteserver_route: driver = manualroute transport = mailbaby_smtp domains = !+local_domains # add senders exclude senders = : [email protected] : !*@domain1.com ignore_target_hosts = 127.0.0.0/8 route_list = * relay.mailbaby.net::25 randomize byname host_find_failed = defer no_more
-
Only use MailBaby when sending to specific domains
To do this edit the domains line. Remove the +local_domains which indicates mailbaby is excluded for all local domains. Instead change to
domains = domain1.com : domain2.com : !*
This would force email to the destination domain1.com and domain2.com through MailBaby excluding the others
remoteserver_route: driver = manualroute transport = mailbaby_smtp domains = domain1.com : domain2.com : !* ignore_target_hosts = 127.0.0.0/8 route_list = * relay.mailbaby.net::25 randomize byname host_find_failed = defer no_more
-
Only use MailBaby when sending from a specific domain
For this add a senders line and instead of ! to negate, remove that to only match the specific domains. * is a wildcard
senders = *@domain1.com : [email protected]
remoteserver_route: driver = manualroute transport = mailbaby_smtp domains = !+local_domains # add senders to include excluding all others senders = *@domain1.com : [email protected] ignore_target_hosts = 127.0.0.0/8 route_list = * relay.mailbaby.net::25 randomize byname host_find_failed = defer no_more
