If you've ever dug through cpanel" class="auto-link">wordpress-missing-a-temporary-folder-upload-error" class="auto-link">cPanel's Email section looking for a way to block a specific sender, auto-delete newsletters you never subscribed to, or reroute invoices to your accountant without touching your inbox, you've probably walked right past the feature that does exactly that: Email Filters. It's tucked between Forwarders and Autoresponders, easy to miss, and genuinely useful once you know how the rules engine works.
Symptom: You Want Rule-Based Mail Handling, Not Just Forwarding
Forwarders copy or redirect mail based on the recipient address. Autoresponders send a canned reply. Neither one looks at the content of a message — who it's from, what's in the subject, how big the attachment is. That's what Email Filters are for. In cPanel they show up as two separate tools:
- Account Level Filtering — applies to one email account (e.g. only
billing@yourdomain.com). - Global Email Filters — applies to every account on the cPanel, evaluated before account-level rules.
Both live under cPanel → Email → Email Filters. Global filters run first, then account filters, then the mail gets delivered (or discarded, or bounced) based on whichever rule matched.
Cause: The Feature Is Powerful but the UI Doesn't Explain Itself
Most support tickets we see about this aren't bugs — they're people not realizing three things:
- Rules are evaluated top to bottom, and cPanel stops at the first rule that matches unless you explicitly tell it to keep checking.
- "Discard" doesn't bounce the message back to the sender — it silently disappears. If you wanted a bounce, you need "Fail" instead.
- Global filters can accidentally catch mail you didn't intend to touch, because they apply to every mailbox on the account, including ones you forgot exist.
Fix: Building Filters That Actually Do What You Expect
1. Blocking a Specific Sender
Go to Email Filters → Manage Filters next to the account you want to protect, then Create a New Filter. Set it up like this:
| Field | Value |
|---|---|
| Rules | From contains spammer@baddomain.com |
| Actions | Discard Message |
If you want a whole domain blocked, use contains with just @baddomain.com instead of a full address — that way every alias from that domain gets caught too.
2. Auto-Sorting Newsletters or Notifications
cPanel's filters can't move mail into IMAP folders directly (that part is done client-side, e.g. with a rule in Outlook or Thunderbird), but you can redirect it somewhere useful. A common pattern for invoices or receipts:
| Field | Value |
|---|---|
| Rules | Subject contains Invoice |
| Actions | Redirect to Email → accounts@yourdomain.com |
Check "Stop Processing Rules" underneath if you don't want later filters to also act on the same message.
3. Rejecting Oversized Attachments
Large attachments can chew through mailbox quota fast. To reject anything over, say, 20MB before it lands in the mailbox:
| Field | Value |
|---|---|
| Rules | Message Size Byte Range from 20971520 to 999999999 |
| Actions | Fail Message with reason "Attachment too large, please use a file link" |
Byte range fields want raw bytes, not MB, which is the usual reason people get this rule wrong on the first try.
4. Global Filters: Use Sparingly
Because global filters run for every mailbox, they're best reserved for account-wide policy — blocking a known spam domain that's hitting several addresses, or rejecting mail with dangerous attachment extensions like .exe or .scr:
| Field | Value |
|---|---|
| Rules | Body does not contain ... (rarely needed) |
| Rules | $header_from: matches regex \.(exe|scr|bat)$ |
| Actions | Discard Message |
Test any global filter against a real message before trusting it on production mail — cPanel has a "Test" button on the filter list that lets you paste in a sample header and body to confirm it matches (or doesn't).
5. Ordering Matters
If you have five filters and the third one says "Stop Processing Rules," filters four and five never run for a matching message. Drag filters into the order you actually want using the arrows next to each rule, and put your most specific rules (exact sender blocks) above your broadest ones (subject keyword matches) so a narrow rule doesn't get shadowed by a wide one earlier in the list.
Prevention: Keep It Auditable
- Name filters descriptively — cPanel lets you title each one, so "Block invoice-scam domain" beats "Filter 3" when you're troubleshooting six months later.
- Review Global Email Filters every few months. It's the one list that affects every mailbox, and it's also the one people forget exists.
- Prefer "Redirect" over "Discard" when you're not 100% sure a rule is correct — a wrongly redirected email is recoverable, a discarded one is gone.
- For serious spam volume, pair filters with your DNS-level defenses (SPF, DKIM, DMARC) rather than relying on filters alone — filters catch what gets through, they don't stop spoofed mail from being accepted in the first place.
Frequently Asked Questions
What's the difference between Account Level Filtering and Global Email Filters?
Account Level Filtering applies to a single mailbox and is managed by that account's user (or you, from WHM/cPanel). Global Email Filters apply to every mailbox under the cPanel account and always evaluate first. Use global filters for policy that should apply everywhere, and account filters for anything mailbox-specific.
Can I filter mail into a specific IMAP folder automatically?
Not from cPanel's server-side filters — they can discard, redirect, fail, or (with the "Stop Processing Rules" flag) simply let mail through. Sorting into folders is a client-side feature; set that rule in Outlook, Thunderbird, or your webmail client's filter settings instead.
Why did my "Discard" filter not bounce anything back to the sender?
That's expected behavior. Discard silently drops the message with no notification to anyone. If you want the sender to get a bounce-back, use "Fail Message" with a custom reason instead.
My filter isn't matching messages I expect it to catch. Why?
Check three things: the field you're matching against (From vs. header vs. body behaves differently), whether an earlier filter already caught the message and stopped processing, and whether you're using "contains" versus "is exactly" — the latter requires an exact match including case in some cPanel versions.
Do Email Filters slow down mail delivery?
No noticeably. Exim evaluates filters as part of normal delivery processing; the overhead is negligible even with dozens of rules. What can slow delivery is a filter with a broad regex on message body content, since that requires scanning full message text — use targeted rules where possible.
