SpamAssassin: Fighting Spam

SpamAssassin is a free utility offered to all InMotion Hosting customers to help combat spam. SpamAssassin works by blocking unwanted email addresses before they reach your email’s inbox. By default, SpamAssassin is disabled so you must enable it within cPanel to take advantage of it’s features.

Note: New cPanel accounts will have Spam Filters instead.

How does SpamAssassin Work?

SpamAssassin is not an email filter, as some other spam prevention tools are. Instead, it determines whether an email is spam as soon as it hits the server. SpamAssassin works on the back end of your email server and has 10 different levels of settings to catch spam. When enabled by default, you will be set to 5. This is mid-range.

What does this default score of 5 actually mean?

How the point system works

SpamAssassin uses a points based system called “hits” to label spam. When it finds particular characteristics in an email it assigns a point value. If the email exceeds the maximum point value you set, the email is flagged as spam.

The lower the score you set, the more email will be caught as spam. For example, a setting of 1 means that only one hit needs to be flagged against an email for it to be considered spam. If you set the score higher, more hits will be required on an email for it to be labeled as spam. So, the lower the score, the more emails should be flagged as spam.

We suggest testing the different settings prior to using a higher setting.

Enabling SpamAssassin

  1. The first step to enabling SpamAssassin is to log into cPanel. Once logged into cPanel, look for the icon called Apache SpamAssassin under the Email section.


  2. Since SpamAssassin is disabled by default you will need to enable it. To do so, click on the Enable Apache SpamAssassin link.


  3. Now that you have enabled SpamAssassin, you will see a confirmation page. Congratulations! You are finshed! Click go back if you wish to modify the settings for SpamAssassin.


Using Filters to Organize Spam

In order to maximize the true power of SpamAssassin, we recommend you set up a Filter/Message rule in your mail client. Emails that are determined to be spam are still delivered to your inbox. Spam will begin with the subject line “SPAM“. By setting up filters in your email client you can sort the mail and have all messages labeled as spam placed into its folder for review later.  This will keep junk mail out of your inbox. To learn how to set up filters in various email clients, please visit our guide on setting up email filters.

Please check the next article on Setting domain MX records to remote settings in cPanel. If you missed our previous article, please see the Import Email Accounts/Forwarders in cPanel tutorial. For more information on this course please visit Using Email.

Thoughts on “SpamAssassin: Fighting Spam

  • SpamAssassin is filtering suspect spam and some legitimate emails too. But they simply vanish and never appear in the spam box I have set up. This has been an ongoing problem for more than a year. Where do suspect spam emails go?

    • Hello Patrick – if SpamAssassin is not set up properly, then it is possible to lose email. If you want to review email that is marked as spam, then the spam box must be enabled. If you feel that you have set it correctly, then please submit a support ticket to our live technical support team. They will be able to review the email logs to see what’s happening.

  • I don’t see any way to change/save the Spam Score other than the default of 5. I would like to make it 3 but there doesn’t seem to be a way to save that. It keeps going back to the default of 5. How can I do that?

    • I advise contact our Live Support team since the behavior you describe is not normal. Support will be able to log in and replicate the problem if it is replicable.

  • Is SpamAssassin necessary for accounts that do not use Webmail? For instance, I have several WordPress sites that send emails via forms, clients whose DNS runs through the server, but everyone is using a remote MX … I have always wondered what benefit SA provided in this scenerio.

    • SpamAssassin can be a good tool for any address receiving email spam only if the email is hosted on the same server. If you are using a remote MX record hosted elsewhere you should see if that server has SpamAssassin or something similar.

      Thank you,

  • Have to admit that spam assassin has always confused me. I have several email addresses. Looks like assassin is set up only once for a domain name- not for each address. Is that correct?  If so, then is it true where is the spam folder created?

    I have had some mystery missing emails forever and just figured out that I was probably trashing them with SA. It is difficult to test as one cannot send self spam to see what happens!



    • Hey Bob!

      I can understand your confusion. SpamAssassin, although it can be VERY helpful, I agree, can also be difficult to tweak the configuration efficiently without being able to test things.

      With that said, check out our guide on Checking the SpamBox “spam” folder. I recommend using the RoundCube Webmail Application as it tends to work better with syncing the spam folder on all your devices as well. Otherwise, I recommend following the Horde instructions which will allow you to show that folder, without having to navigate through settings/menus.

      As far as configuring SpamAssassin, I always recommend disabling the auto-delete feature while configuring it with a stricter score (Note: the lower the score, the more emails will be identified/flagged as spam) and consistently monitoring the SpamBox for false positives. As you monitor your Inbox and Spam folder, you can lower or raise the score. Once you find a satisfying/comfortable score number and have added a whitelist/blacklist, go ahead and enable the “auto-delete” feature. I hope this helps! Please feel free to leave a comment if you have any further questions, we’re always happy to help!

  • Watch out: there are almost ZERO configuration options for spam assassin and you can’t alter the ~/.spamassassin/user_prefs file to fine-tune the settings when you are on a shared or reseller plan.

    The problem with this is that inmotion has their spamassassin setup to prefix all suspected spam with ‘***SPAM***’, so it is an eyesore in your inbox. The hit rate is 50/50 so you have legit mails marked as ***SPAM***

  • For VPS, look up MagicSpam and Greylisting, both are great.  I wish they were offered as plugins for the reseller WHM!

    • I use SpamAssassin but get an insurmountable amount of spam on two of my email addresses. Consequently the quotas (which I’ve raised a few times) get maxed out almost daily and I have to clear the spam box daily or we can’t send or get mail on those accounts. To be clear, it’s not that SpamAssassin isn’t catching spam, it’s that there’s SO much of it (spam counts toward the quota) that those two email addresses are being rendered nearly unusable. How can I stop spam from eating up all my quota??

    • Sharpsburgian, spam email will only count against your quota if your a subsequently forwarding email to another account. This then counts the new message as a sent email for your account. You would need to disable your email forwarders to prevent this from counting as your sent mail. Alternatively, you may wish to review, and possibly implement our new SpamExperts service.

  • I can’t figure out how to find the spam box.  Can you tell me how.  I configured spam assasin and brought the number way down, but I think I may have missed some emails.



  • I’m disappointed in this aspect of InMotion’s service. I’m transferring over from a much less respected hosting company that allows spamassassin training in shared servers. They simply have sa-learn installed locally and you can then run cron jobs to handle the training. Is there no option for installing sa-learn locally?

    • Hello Mike,

      Sorry for the difference in policy with SpamAssassin. Part of the reason with the Spamassassin self-learning not activated has to do with the performance of the server. You can always manually use filters to stop many of the issues as well, but I can understand the convenience of the self-learning system. There is also a replacement system for the departing McAffee option to filter spam called SpamExperts. This is a paid solution, but it another solution that can be used to help stop spam from hitting your email account.

      If you have any further questions or comments, please let us know.

      Arnel C.

  • For items that got flagged as spam incorrectly… is adding it to the whitelist the only way to fix that?  (Some email clients have a “not spam” button, or something similar)


    Thank you,



  • Hello. Is there a way to keep SpamAssassin from modifying the subject line of emails it determines to be spam? I can use the other items in the header (i.e. X-Spam-Status) to filter spam emails using my email client but on occasion I do receive emails marked as spam that are not. For these emails I can add rules in my email client to catch them but SpamAssassin has already modified the subject line which makes them more difficult to organize. Thanks for your help.

  • Just set up SpamAssassin, and enabled the spam folder but I’m not seeing it on the webmail. Also set the filter to level 7 and still seeing an awful lot of spam come through – I’m nervous about setting it much higher lest I filter out valid senders too?

    • Hello Catherine,

      If you have enabled the spam folder and Spam Assassin, then you should see the folder in Webmail – once spam has been detected (it won’t show if there is no spam). If you are not seeing it, then we can look into the issue, but we need more information about your account (if you are an InMotion customer). We would need the mail account information as well.

      If you have any further questions or comments, please let us know.

      Arnel C.

  • I am getting hundreds of spam and junk email and don’t know what to do about it. I use outlook so not sure if that is doing anything to contribute to he amount of junk I’m getting. I have the settings set for 1:1 but it doesn’t seem to be helping at all.

  • I’ve discovered that if you’re on a VPS, you can set up a cron job to run sa-learn.  I do not know about other forms of hosting, however.  I have been told that you can run sa-learn from the command line IF you have shell access on your account, but you have to have a VPS account or higher.

  • Is it possible to run sa-learn from the command line?  I have a small shell script that ran sa-learn on my previous host so that I could update HAM and SPAM.

  • Is there anything in place on VPS accounts that runs Bayes learning/filter programs automatically, or will I need to set that up myself through a cron job?  It appears as though something is happening with Spamassassin learning something, but I’m really not too sure.

    • Hello Craig,

      Thank you for contacting us. While, we do not have system like that in place, you definitely have the ability to set it up, or configure it.

      If you are having trouble, or have a specific question about Spam Assassin, we would be happy to help you.

      Thank you,

    • Hello Lori,

      While version may vary slightly from server to server, it appears that we are using SpamAssassin 3.3.1

      Kindest Regards,
      Scott M

  • I was receiving a lot of “junk” email so I played around with all the spam filters. Good news it stopped everything. The bad news it stopped EVERYTHING! I have disabled everything I could find, but now if someone sends an email to me, the system sends a “challenge” email back to them. If it is a human and they reply to the challenge email they get an email telling them that they are on the whitelist and can now send an email. How do I turn off the challenge part?

    • Hello Jim,

      That sounds like you still have the BoxTrapper still running. Disabling that will stop the challenge emails from being sent.

      Kindest Regards,
      Scott M

    • Hello Tim,

      Thank you for your email spam box question. Yes, since IMAP leaves all the files on the server by default, any client connecting via IMAP should be able to see all the folders including the Spam box.

      Ensure you Subscribed to your INBOX in Outlook, so you can view all folders available on the server.

      If you have any further questions, feel free to post them below.

      Thank you,

  • I’ve never ONCE seen a spam e-mail come through my SpamAssassin filter with “spam” appended to the subject line.  I’ve got my Spam Score set to 1.1, and I specifically added rules to my configuration file that call for the subject to be modified.

    • Hello Craig,

      Thanks for the comment. If you want to see if you’re getting any spam, log in to webmail then look for the SPAM folder and see if spam is being stored in the folder. Otherwise, you may not be receiving any spam into your account.

      Arnel C.

  • if I setup 3 that means I can stop more spam emails. I am getting lot fo junk email as zip files? how do I stop those. like the messages from AutoWarranty,

    • On shared hosting accounts, it is not possible to filter zip files, however, on a VPS or dedicated server, ClamAV can be set up which will scan and remove unwanted zip files.

  • It seems the instruction on this page counter the instructions on Spam Assasin…they say set the number higher (for ISP) ” but if you’re an ISP installing SpamAssassin, you should probably set the default to be more conservative, like 8.0 or 10.0″ 

    • When SpamAssassin identifies any spam, it will automatically place the word spam within the subject line.

Was this article helpful? Let us know!