MailScanner on cPanel and WHM: Status and Alternatives

Updated: 4 November 2026 · Applies to: cPanel & WHM 138 (Exim, Apache SpamAssassin, ClamAV plugin) · MailScanner 5.5.3 · ConfigServer MailScanner Front-End (discontinued)

There is no maintained way to install MailScanner on a cPanel & WHM server any more. The usual method used ConfigServer's installer and its MailScanner Front-End (MSFE), downloaded from configserver.com. That download server no longer answers, ConfigServer's developers no longer maintain their software (for CSF, cPanel gives the date as 31 August 2025), and cPanel took over only CSF. To filter spam on a cPanel server, use the tools cPanel & WHM already includes: Apache SpamAssassin, blocklists (RBLs) in Exim and, if you need virus scanning, the ClamAV plugin.

Current status

• ConfigServer MailScanner Front-End: discontinued. The final copies of ConfigServer's scripts are kept in the way-to-the-web branch of cPanel's GitHub repository cpanel/cpanel-csf. They contain no MailScanner installer, only an uninstaller, and the README there says there is no intention to update any of these files.
• CSF: cPanel maintains it as the cpanel-csf package. The repository README says "We are only developing CSF here", so the other ConfigServer products are not developed there. See How to Install CSF Firewall on cPanel and WHM.
• MailScanner itself is a separate open-source project (MailScanner/v5 on GitHub). Its latest release is 5.5.3-2 (November 2024), with packages for Red Hat, Debian and SUSE based systems. Its source code contains no cPanel integration.

Turn on spam filtering for the whole server

According to cPanel's documentation for version 138:

1. In WHM, open Home » Service Configuration » Service Manager. Make sure Apache SpamAssassin (spamd) has Enabled and Monitor selected, and save.
2. Open Home » Service Configuration » Exim Configuration Manager and stay on the Basic Editor tab.
3. In Apache SpamAssassin Options, set Apache SpamAssassin: Forced Global ON to On. Every account's mail is then scanned, and users cannot switch scanning off.
4. Optional: on the ACL Options tab, Apache SpamAssassin reject spam score threshold rejects incoming messages above the score you set. On the Filters tab, Apache SpamAssassin: bounce spam score threshold bounces them instead (default: no bouncing).
5. On the RBLs tab, turn on RBL: zen.spamhaus.org and RBL: bl.spamcop.net to reject mail at SMTP time from hosts on those lists. Both are off by default. Each list has its own terms of use, so check them for a busy mail server.
6. To stop your own users from sending spam, turn on Scan outgoing messages for spam and reject based on the Apache SpamAssassin internal spam_score setting in the SpamAssassin options.
7. Save your changes.

Scan email for viruses (optional)

1. Install ClamAV from Home » cPanel » Manage Plugins. cPanel strongly recommends at least 3 GB of RAM on the server for ClamAV.
2. In Exim Configuration Manager, on the Security tab, turn on Scan messages for malware from authenticated senders (exiscan) and Scan outgoing messages for malware. These options appear only after ClamAV is installed.

Let each account tune its own filter

Account owners use cPanel » Home » Email » Spam Filters:

• Process New Emails and Mark them as Spam: turns scanning on for the account.
• Spam Threshold Score: a low score, such as 1, catches more spam but also real mail; a high score, such as 10, marks only obvious spam. See How to Configure the SpamAssassin Score Setting?
• Move New Spam to a Separate Folder (Spam Box): keeps spam in a spam folder instead of deleting it. It appears only when the server has Enable Apache SpamAssassin Spam Box delivery for messages marked as spam turned on in WHM's Tweak Settings.
• Automatically Delete New Spam (Auto-Delete): deletes mail at or above its own score for good, including any real messages among it.
• Whitelist and Blacklist: always allow or always mark senders; *@example.com covers a whole domain. See How to Configure the SpamAssassin Whitelist?

If an account has no Spam Filters icon, check its feature list in WHM » Home » Packages » Feature Manager (features Apache SpamAssassin and Apache SpamAssassin Spam Box).

Still running ConfigServer MailScanner?

An existing installation keeps working but gets no fixes. ConfigServer's own uninstaller for MailScanner and MSFE is in the way-to-the-web branch of cPanel's repository (folder uninstallers/MailScanner). Its README still points to the old ConfigServer GitHub address, which no longer exists, so download the two files from cPanel's copy. We could not run it (no cPanel test server); according to its source, it stops and disables MailScanner, removes /usr/msfe and MailScanner's cron jobs, sets Exim's system filter to /etc/antivirus.exim, removes the MSFE lines from Exim's local configuration, rebuilds and restarts Exim, moves queued messages back into Exim's queue and deletes MailScanner's folders.

1. Take a full backup, and copy the Exim files the script changes:

   mkdir -p /root/exim-backup
   cp -a /etc/exim.conf.local /etc/exim.conf.localopts /root/exim-backup/

2. Download the uninstaller into one folder and read both files before you run anything:

   mkdir -p /root/msuninstall && cd /root/msuninstall
   curl -sSLO https://raw.githubusercontent.com/cpanel/cpanel-csf/way-to-the-web/uninstallers/MailScanner/msuninstall.pl
   curl -sSLO https://raw.githubusercontent.com/cpanel/cpanel-csf/way-to-the-web/uninstallers/MailScanner/msuninstall.sh

3. These files are cPanel's archived copy of ConfigServer's uninstaller, which no longer receives updates, and we could not test them on a cPanel server: take a full server backup or snapshot first. In a quiet period, run it as root from that folder: bash msuninstall.sh
4. In Exim Configuration Manager, on the Filters tab, check System Filter File. The script points it to /etc/antivirus.exim, an older path; cPanel's default in version 138 is /etc/cpanel_exim_system_filter.
5. Send test messages to and from an account on the server and check WHM's Mail Queue Manager for stuck mail.
6. Turn on SpamAssassin as shown above, including spamd in Service Manager and the SpamAssassin features in Feature Manager if they were switched off.

Frequently asked questions

Why does the MailScanner installer download fail?
It came from configserver.com, which no longer answers.

Is there a newer MailScanner plugin for cPanel?
We found none. ConfigServer's final copies contain no MailScanner installer, cPanel's repository develops only CSF, and MailScanner's own packages have no cPanel integration.

Too much real mail is marked as spam. What should I change?
Raise the Spam Threshold Score in cPanel » Email » Spam Filters and add trusted senders to the whitelist.

More on spam settings in cPanel: How to Enable the SpamAssassin Spam Filter in cPanel?

Need help with email on your server?

• cPanel server management: hardening, migrations and monitoring by our engineers.
• Hire an Expert: an engineer for the time you need, from $8 per 15 minutes, no contract.
• Email server hosting: dedicated mail servers with port 25 open.

Official documentation: cPanel: Exim Configuration Manager Basic Editor and cPanel: Spam Filters.