Ever wandered your way into Webhost Manager, and asked yourself what all those Exim options mean? If so, read on!
The first section is the Access Lists section, which controls blacklists and whitelists for connecting to Exim. The first 5 checks are recommended, as it will make delivering mail to your server easier. Uncheck the 6th option, “Whitelist: Trusted Mail Hosts/IP Blocks”.
Next is ACL Options, which is where most of your policy and security settings will be. I set my first two options to “0″ because I don’t have mailing lists or spammers on my server, but depending on your situation, you may want to set them accordingly. Check the next two boxes for SpamAssassin and dictionary attacks.
[X] Require incoming SMTP connections to send HELO before MAIL
This will require the sending host to send a valid HELO/EHLO (mail greeting) before any messages can be delivered. Basically, introducing yourself before you speak.
[X] Require incoming SMTP connections to send a HELO that does not match the primary hostname or a local IP address.
This will require that mail being sent to your server is prefaced with a HELO greeting that doesn’t match your server’s hostname or Primary IP address.
I usually unblock the next two options, because it has a tendency to break some mail clients.
[X] Blacklist: SPF Checking
Always enable this. This controls SPF validation. SPF is Sender Policy Framework which is a framework for verifying domain-based mail senders have authority to send mail, according to a DNS record called a TXT record. This is basically another access list, but instead of being local, it’s remote. What this does is when mail is sent, it looks up the domain the message is coming from, and attempts to find the SPF record by querying for record type TXT. The record itself contains IP groups and hostnames that are allowed to send mail as that domain. If it doesn’t validate, the mail isn’t accepted. If it does validate, it continues on to any other ACLs the message hits (ie: SpamAssassin, Rate Limiting) before it’s delivered.
Uncheck everything in the Domains and IPs section, because once you’re done with this guide, you should be pretty safe to not separate IP addresses for mail.
Accept the defaults in the Filters section. This will control what happens to spam, and the filters there are correct by default.
Under the Mail section, check the following:
- Add sender rates in the mail log
- Reject mail for users over quota at SMTP time.
- Set the Sender: Header when the mail sender changes the sender (-f flag passed to sendmail).
Uncheck everything else under Mail.
In the next section, RBLs, check both boxes to enable both Spamcop and Spamhaus Blacklist Checkers, you can even add your own by clicking [Manage].
In the SpamAssassinTM Options section, check the top box to enable SpamAssassin globally without the option for users to disable it, and set the field below it to 1/16th of your RAM in MB. Example: 4096/16 = 256
Then, click Save at the bottom, and Exim should restart itself, and you’re done in WHM.
Then, for each of your cPanel accounts, go into Mail -> Default Address, and select Discard, and put a custom message beside it. Try to be as nondescriptive as possible, something like:
Mailbox for this account is currently unavailable
Make sure to limit the amount of Autoresponders you have. By design, they respond to every message sent to it, regardless of whether it exists or not. This is an easy way to get blacklisted.
Also, try to avoid the usage of Boxtrapper, as it does almost the same thing, except it only sends return messages until the recipient is verified by either the user or by Boxtrapper.
That’s all for today folks! Happy emailing!