{"id":56329,"date":"2020-07-23T11:33:53","date_gmt":"2020-07-23T16:33:53","guid":{"rendered":"https:\/\/blog.cpanel.com\/?p=56329"},"modified":"2020-07-23T11:33:53","modified_gmt":"2020-07-23T16:33:53","slug":"spam-filtering-on-cpanel-everything-you-need-to-know-about-spamassassin","status":"publish","type":"post","link":"https:\/\/devel.www.cpanel.net\/blog\/tips-and-tricks\/spam-filtering-on-cpanel-everything-you-need-to-know-about-spamassassin\/","title":{"rendered":"Spam Filtering on cPanel: Everything You Need To Know About SpamAssassin"},"content":{"rendered":"\n
Spam is a huge challenge for anyone who hosts email, even though users only see a tiny fraction of the spam they\u2019re sent. Most unwanted messages never reach inboxes, but an incredible 54 percent of all email traffic is spam<\/a>, and that\u2019s down from 70 percent a decade ago. <\/p>\n\n\n\n The good thing is ISPs and hosting providers are better at stamping out spammers, and users are more aware of the risks. Still, hundreds of billions of messages are sent every year by automated botnets that collect email addresses, compromise servers, and bombard users with malicious advertising and phishing attacks.<\/p>\n\n\n\n If you host email, you need a way to identify and filter unwanted messages, and cPanel integrates one of the most sophisticated filtering tools available. Apache SpamAssassin<\/a> flags spam to remove it before<\/em> it gets to users. <\/p>\n\n\n\n To make sure we understand how it works, let\u2019s take a close look at what SpamAssassin is, how it works, and the best settings for SpamAssassin in cPanel.<\/p>\n\n\n\n We all receive spam and can recognize what it is right away. We know what it looks like, and, usually, alarm bells start ringing in our minds even if we can\u2019t say precisely why. When that happens, we\u2019re pattern-matching: our brains have learned to associate specific words, phrases, typography, and grammar with unwanted email.<\/p>\n\n\n\n SpamAssassin works in the same way but on a much bigger scale. It looks for patterns that are common in unwanted email and, if a message matches lots of patterns, tells us that it\u2019s probably not something you want to see.<\/p>\n\n\n\n Email filtering isn\u2019t an exact science. Language is complex; the definition of \u201cunwanted email\u201d changes depending on the context, and spammers try to hide their real goal.<\/p>\n\n\n\n However, the software has been refined over many years with hundreds of sophisticated tests that can identify junk mail with great accuracy.<\/p>\n\n\n\n SpamAssassin ships with around 1,000 tests and each email message is subjected to about 600 or more individual tests.<\/p>\n\n\n\n The SpamAssassin score tells us how likely an email is to be spam. Each test has a number associated with it, often a small number like 0.1 or \u20130.2. As messages are analyzed, the software keeps a running total, adding the individual test results to produce a combined score.<\/p>\n\n\n\n The lower the score, the more likely a message is legitimate. If a message scores ten, it is<\/em> definitely spam. If it\u2019s a three, it has some of the qualities of junk mail, but the software is less confident.<\/p>\n\n\n\n It\u2019s important to understand the SpamAssassin score because you can use it to configure email filtering sensitivity in cPanel, as we\u2019ll talk about in the next section.<\/p>\n\n\n\n SpamAssassin is fully integrated into the cPanel interface, and you can tweak its settings to get exactly the right spam filtering<\/a> functionality for your users. To configure it, select Spam Filters in the Email section of the cPanel Home interface.<\/p>\n\n\n\n <\/p>\n\n\n\n The first setting on the Spam Filters overview page is \u201cProcess New Emails and Mark them as Spam.\u201d<\/p>\n\n\n\n <\/p>\n\n\n\n This is the switch that turns email testing on and off. When it is on, SpamAssassin marks high-scoring emails by inserting ***SPAM*** into the message\u2019s header.<\/p>\n\n\n\n <\/p>\n\n\n\n Just below \u201cProcess New Emails\u201d is the Spam Threshold Score setting.<\/p>\n\n\n\n <\/p>\n\n\n\n Earlier, we said that SpamAssassin generates a score by adding up the results of many tests. The Threshold lets cPanel users configure the score above which the software considers a message to be spammy.<\/p>\n\n\n\n For example, if you set the Spam Threshold Score to two, the software flags any email with a score above two. A low threshold leads to very sensitive filtering, and will likely cause non-spam messages to be flagged (false positives). In contrast, a threshold of ten is permissive; non-spam isn\u2019t flagged, but some unwanted messages will make it through (false negatives).<\/p>\n\n\n\n The default setting is five, which is a good balance between sensitivity and too many false positives.<\/p>\n\n\n\n When the Spam Box is activated, flagged messages are moved to a separate folder. Unwanted email is kept out of the inbox, but saved so that you can review it and move any incorrectly identified messages. For the typical user, the Spam Box should be turned on unless you have another method of filtering legitimate messages.<\/p>\n\n\n\n The next setting, Auto-Delete, does exactly what you expect it to. When it\u2019s activated, flagged messages are deleted immediately.<\/p>\n\n\n\n Auto-Delete does not use the Spam Threshold Score; it works with an independent Auto-Delete Threshold Score so that you can set different thresholds for identification and deletion.<\/p>\n\n\n\n You cannot recover a message after it is deleted. For most users, we recommend the Spam Box instead of Auto-Deletion because it allows you to review messages to see if they are incorrectly flagged.<\/p>\n\n\n\n Click on \u201cShow Additional Configurations\u201d to reveal advanced settings. These settings are rarely changed, but you may find whitelists and blacklists useful. (Note that these terms are likely to change in the future<\/a> to make them more inclusive.)<\/p>\n\n\n\n The whitelist is a list of email senders that are always allowed through the filter even if their messages are flagged. The blacklist is the opposite; messages from senders on the blacklist are prevented from entering inboxes.<\/p>\n\n\n\n To add a sender to the whitelist, select \u2018Add A New \u201dwhitelist_from\u201c Item\u2019 and enter a sender email address. You can use wildcards such as \u201c?\u201d to match any character and \u201c*\u201d for multiple characters.<\/p>\n\n\n\n The final setting, \u201cCalculated Spam Score,\u201d allows you to change the score associated with a test. Advanced users should only use this setting. SpamAssassin developers calibrate scores, and changing them is likely to have unpredictable side effects.<\/p>\n\n\n\n For most users, configuring SpamAssassin is as simple as activating it and choosing whether to use the Spam Box or Auto-Delete. You may need to adjust the default Threshold Score to suit your email hosting scenario, but once that\u2019s done, SpamAssassin will work in the background to ensure that spam ends up where it belongs.<\/p>\n\n\n\n Any company that is flooded with hundreds of spam messages each day, and thousands per week, is in danger of being compromised. The risk of exposing your email addresses or compromising your servers is one that is not worth the fallout. Identifying and filtering unwanted messages requires greater security tools like Apache SpamAssassin<\/a> which is specifically designed to identify spam before it gets where you don\u2019t want it to go. <\/p>\n\n\n\nWhat Is SpamAssassin and How Does It Work?<\/strong><\/h2>\n\n\n\n
What is the SpamAssassin Score?<\/strong><\/h2>\n\n\n\n
The Best Settings for SpamAssassin in cPanel<\/strong><\/h2>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure><\/div>\n\n\n\n
Configure the SpamAssassin Threshold Score<\/strong><\/h3>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
Configure SpamAssassin Auto-Delete<\/strong><\/h3>\n\n\n\n
<\/figure>\n\n\n\n
Advanced cPanel Spam Filter Settings<\/strong><\/h3>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n