September 17, 2022 . 2 MIN READ
Is your server at risk of being blacklisted? Spammers frequently target compromised websites and mail accounts to send thousands of unauthorized emails. By the time a host detects the surge, the server’s IP reputation is often already destroyed, causing legitimate mail to bounce or land in junk folders.
At Velan Server Support Services, we specialize in helping SME hosting providers recover from spam incidents and implement proactive defenses to keep IPs clean.
Approximately 76% of spam in web hosting environments originates from email spoofing—where a sender uses a fake or invalid “From” address. This leads to:
Queue Bloat: Thousands of bounce-back failure messages clogging your mail queue.
Reputation Damage: Your server being identified as a source of “CEO fraud” or phishing.
Blacklisting: Major providers (Gmail, Outlook) blocking your entire IP range.
Typically, spoofed emails originate from three sources:
Vulnerable PHP/mail scripts.
Compromised email credentials.
Weaknesses in default mail server configurations.
To secure your cPanel server, we implement custom Access Control List (ACL) rules within the Exim mail server. These rules verify the domain in the “From” header against the server’s Local Domains and Remote Domains lists. If the domain doesn’t match, the email is rejected before it ever leaves your server.
[!CAUTION] Warning: Editing the Exim configuration file requires extreme precision. A single syntax error can take your mail server offline. Always back up your configuration before making changes.
To prevent scripts from sending mail using unauthorized “From” headers, add the following code block under the acl_not_smtp section:
deny
condition = ${if !match_domain{${domain:${address:$h_From:}}}{+local_domains : +remote_domains : +allow_domains}}
message = Sorry, you don’t have permission to send email from this server with a header that states the email is from ${lc:${domain:${address:$h_from:}}}
accept
Even if a user has a valid login, they should not be allowed to “ghost” as a different domain. Add this code below acl_check_data or your SMTP authentication filters:
deny
authenticated = *
condition = ${if !match_domain{${domain:${address:$h_From:}}}{+local_domains : +remote_domains : +allow_domains}}
message = Sorry, you don’t have permission to send email from this server with a header that states the email is from ${lc:${domain:${address:$h_from:}}}
accept
Managing mail server security is a full-time job. Velan’s engineers can help you set up custom security rules, monitor outbound traffic, and ensure your server maintains a 10/10 deliverability score.
Reference:
