Apache SpamAssassin in cPanel: Tune Spam Score & Auto-Delete

You turn on Apache SpamAssassin in cPanel expecting your inbox to get cleaner. A week later either nothing's changed and junk mail keeps landing in the inbox, or the opposite happens — a client's invoice email vanishes and you find it sitting in the "spam" folder with a score of 6.2 next to it. Both problems come from the same place: SpamAssassin ships with a default configuration that's a compromise, not a fit for your mailbox, and most people never touch the three settings that actually matter.

Symptom: Spam Gets Through, or Real Mail Gets Flagged

There are really two support tickets hiding under one feature. The first: "I enabled SpamAssassin and I'm still getting spam." The second, usually a week later: "Where did this email go? The sender says they sent it Tuesday." Both point back to the same control panel screen — cPanel → Email → Apache SpamAssassin — and the handful of numbers on it that nobody explains.

Unlike Email Filters (the rule-based tool for blocking specific senders or subjects), SpamAssassin doesn't match exact text. It scores every incoming message against dozens of heuristics — sender reputation, header formatting, phrases, links, even how the HTML is structured — and adds up a number. Cross a threshold, and the message gets tagged or deleted. Get the threshold wrong in either direction and you'll see one of the two symptoms above.

Cause: The Default Score Isn't Tuned for Your Mail

cPanel's default required_score is 5.0. That's a reasonable general-purpose number, but it wasn't chosen for your specific mix of senders. A few things commonly throw it off:

• Auto-delete is enabled at too low a score. If someone set the auto-delete threshold to match (or come close to) the tagging threshold, borderline legitimate mail gets silently destroyed instead of just marked.
• Bayes filtering was never trained. SpamAssassin's Bayesian engine gets smarter the more you feed it, but out of the box it has no idea what "your" spam or "your" ham (legitimate mail) looks like.
• Newsletter and marketing mail always scores borderline. Legitimate cold outreach, receipts from payment processors, and bulk marketing tools often trip several rules just by their structure — tracking links, unsubscribe footers, HTML-heavy layout — even when nobody would call them spam.
• No one is checking the spam folder. If tagged mail is being routed to a folder nobody reads, it feels like the problem is "email going missing" rather than "email correctly flagged but never reviewed."

Fix: Tune the Three Settings That Matter

1. Confirm SpamAssassin Is Actually On

Go to cPanel → Email → Apache SpamAssassin and check the status. If it says disabled, click Enable Apache SpamAssassin. This alone doesn't delete or move anything yet — it just starts scoring and tagging the subject line with *****SPAM***** by default.

2. Set the Required Score Deliberately

Click into Configure Apache SpamAssassin and look for required_score. The cPanel default is 5. For a mailbox that's getting flooded with obvious spam, dropping it to 4 catches more. For one where legitimate B2B or marketing mail keeps getting tagged, raising it to 6 or 7 gives borderline mail more room. Change it by one point at a time and watch results for a few days before adjusting again — jumping straight to 3 or straight to 8 tends to overcorrect.

3. Separate "Tag" From "Auto-Delete"

This is the setting that causes the most damage when it's wrong. Under the same configuration screen, look for the auto-delete score (sometimes labeled as a separate threshold from the tagging score). If it's set anywhere close to your required_score, borderline mail gets deleted instead of just marked. A safer pattern:

If you want auto-delete at all, leave a wide gap between the two numbers. A common, safer setup is: tag at 5, delete at 12 or higher — or don't enable auto-delete on a mailbox at all and instead set up a mail client rule to move tagged mail into a Junk folder, so nothing is ever silently destroyed server-side.

4. Whitelist Senders You Always Want Through

In the same configuration screen there's a Whitelist section. Add addresses or whole domains (*@vendor.com) that should never be scored as spam — your payment processor, your CRM's transactional email domain, a client you email daily. This bypasses the scoring entirely for those senders, which is more reliable than trying to nudge the global score down to accommodate them.

5. Train Bayes With Real Examples

If you have shell access, training the Bayesian filter directly makes a bigger difference than any score tweak:

sa-learn --spam /home/user/mail/domain.com/user/.spam/cur
sa-learn --ham /home/user/mail/domain.com/user/cur

Point --spam at a folder full of confirmed junk and --ham at a folder of confirmed legitimate mail. Run this after collecting a decent sample (a few hundred messages of each ideally), and re-run it periodically as new spam patterns show up. Over time the scoring gets noticeably more accurate for your specific mail traffic.

Prevention: Keep It From Drifting Back

SpamAssassin isn't "set once and forget." A few habits keep it useful:

• Check the folder tagged mail lands in at least weekly, especially right after changing the score.
• Re-run sa-learn periodically, or automate it with a monthly cron job pointed at your spam/ham folders.
• Keep your SPF, DKIM, and DMARC records correct — SpamAssassin's score is partly influenced by authentication failures, so a broken SPF record makes your own outgoing mail more likely to get flagged elsewhere, and makes spoofed mail impersonating your domain score lower than it should.
• Review the whitelist every few months. Vendors change sending domains more often than you'd expect, and an old whitelist entry does nothing for a sender using a new one.
• If you manage multiple cPanel accounts, don't assume one score fits all of them — a support inbox that receives high volumes of automated notifications needs different tuning than a personal mailbox.

If you've tuned all of this and spam is still getting through consistently, that's usually a sign the sending domains involved have decent reputations and pass SPF/DKIM — at that point, Email Filters (blocking by sender or subject) or a dedicated filtering service in front of your mail is a better tool than pushing SpamAssassin's score lower and risking more false positives.

Frequently Asked Questions

Will enabling SpamAssassin slow down mail delivery?

There's a small processing delay per message since each one gets scored, but it's typically well under a second and not noticeable in normal use. It won't cause the multi-minute delays that queue backlogs or DNS lookup failures can.

Why does legitimate marketing email always get flagged?

Bulk marketing tools often trigger multiple SpamAssassin rules just by their structure — heavy HTML, tracking links, list-unsubscribe headers, and sending from shared IP ranges with mixed reputation. Whitelisting the specific sending domain is more reliable than lowering your overall required_score to compensate.

Can I use SpamAssassin instead of Email Filters?

They solve different problems. SpamAssassin scores mail based on content and reputation heuristics; Email Filters match exact rules you define, like blocking one address or redirecting messages with a specific subject. Most mailboxes benefit from using both together.

Where does auto-deleted spam actually go?

Nowhere — that's the point of the setting, and why it's risky. Once a message crosses the auto-delete threshold, Exim discards it before it ever reaches the mailbox. There's no recovery folder to check, which is why leaving a wide gap between the tag score and the delete score matters.

Do I need shell access to train Bayes, or can I do it from cPanel?

cPanel's UI doesn't expose Bayes training directly — it's done via the sa-learn command over SSH. If you're on shared hosting without SSH access, ask your host to run it against your spam and ham folders, or focus on whitelist entries and score tuning instead.