MailScanner (http://sng.ecs.soton.ac.uk/mailscanner/) is a technology that automatically
scans all mail for not only viruses (if your web host has this installed), but also scans for spam
using SpamAssassin (which can also include some custom rulesets and other anti-spam plug-ins),
phishing attacks, web bugs, and other e-mail exploits.
The MailScanner front end for cPanel is maintained by http://configserver.com/. This interface
replaces cPanel's standard SpamAssassin and SpamBox features as well as cPanel Pro's ClamAV
virus scanner and provides additional features you just don't get with cPanel's standard features.
Clicking on the MailScanner icon brings you to the screen you see opposite. This screen may look a
little intimidating at first, but once you take the time to explore, you'll find that it is quite easy to use.
Exploring MailScanner Front End's Many Features
At the top of the screen, you will see a numerical legend that is used in the tables here. Just below
that are the links to the e-mail black/white list and other settings. Just below those links are the
current MailScanner settings for your domain(s) and subdomains.
If you do nothing, e-mail will be scanned for viruses by default and any messages with viruses will
be immediately deleted without being delivered. Checks for spam will also be run, but all spam will
be delivered normally to your e-mail accounts (the subject line will be modified to note if the
message is probably spam so you can filter it). If you do not like these defaults, you can change them
for all domains and subdomains at once or have different settings for each domain or subdomain.
The next table is titled Change All Domain Settings and is used if you need to make changes to all
domains and subdomains that are part of this cPanel account. The first column notes that this will
affect all domains and subdomains.
Spam Scanning: The second column allows you to set whether incoming e-mail is scanned for
spam or not (outgoing mail is always scanned for spam and viruses regardless of the settings here).
Low Scoring Spam: This column affects what happens if SpamAssassin decides a message is
low-scoring spam and spam scanning is on. Low-scoring spam is probably spam, but might also
be legitimate e-mail. A message is low-scoring spam if it scores above the minimum low-scoring
spam threshold (which can be set in the Other Settings screen discussed later) but that is less than
the minimum high-scoring spam threshold (which can also be set in the Other Setting screen). The
default low-scoring spam threshold number is five and the default high-scoring spam threshold is
twenty. This means that if SpamAssassin score is more than 5 and less than twenty, the message
will be considered to be low-scoring spam by default. You can choose to deliver the spam, delete
it, or forward it to a particular e-mail address.
• Deliver sends the scored e-mail with a modified subject and headers to your inbox.
You can then use standard cPanel mail filters on the mail or have your e-mail client
take care of sorting the spam. Low-scoring spam will have {Spam?} added to the
beginning of the subject line so it is easier to filter out.
• Delete immediately deletes the mail once it has been determined to be spam. The
mail is not bounced back to the sender; it is simply deleted without any other notice.
• Forward to spam@(sub.)domain.com sends the mail to that address rather than
delivering it to the intended address. This allows you to duplicate the SpamBox
feature that cPanel normally has, but with more control. If you choose this, you
should either create a forwarding address for spam@domain.com or create a real
e-mail POP3/IMAP account so the spam has some place to go. Since you can create
a forwarder for this address, you can forward spam to as many other locations as you
want, by creating a forwarder that sends to multiple addresses. For example, if you
have a spamcop.net account, you can forward the mail to SpamCop for processing.
For this option, the e-mail address is always set to spam@domain.com or
spam@sub.domain.com; you cannot change the actual address listed here.
• Forward to other@domain.com may also be listed as an option if you've specified another
e-mail address to forward mail to in the Other Settings area. This e-mail address can be
any address at any domain; it doesn't have to be some domain hosted by you.
High-Scoring Spam: High-scoring spam is almost certainly real spam. By default, that is any
e-mail message with a SpamAssassin score of 20 or higher (which you can change in the Other
Settings area). You have exactly the same options as for low-scoring spam: deliver, delete or
forward the mail. Delivered high-scoring spam will have {Definitely Spam?} added at the
beginning of the subject line so you can filter it out using cPanel mail filters or your e-mail client's
filters. We recommend that you delete high scoring spam.
Virus Scanning: Turns virus scanning on or off. Virus scans are done by ClamAV (or whichever
virus scanner your web host has installed).
Deliver Cleaned E-mails: Most virus scanners have the ability to attempt to clean attachments
that contain viruses. It is quite rare these days that an infected attachment can be successfully
cleaned. For this reason, you should choose not to deliver cleaned e-mails.
If you make changes to any settings, be sure to click the Change button under the table you made
changes in.
Changes to MailScanner settings are not applied immediately. There can be a ten-minute
wait before your new settings become active.
Below the Change All Domains Settings table is the Change Individual Domain Settings table,
which allows you to make the same changes as above to each domain or subdomain separately.
E-mail Black/Whitelist Settings: On this screen, you can set up e-mail addresses or even entire
domains that you either do or do not want mail from. Any addresses in the spam whitelist won't be
scanned by SpamAssassin but will be scanned for viruses and if the message does not contain a virus, it
will be immediately delivered to the appropriate mail account. This is great if you want to make sure
mail from a particular domain or e-mail address is never accidentally labeled as spam. On the other
hand, any addresses or domains in the spam blacklist will automatically be labeled by MailScanner as
high-scoring spam, and the appropriate action based on your preferences will be taken.
Other Settings: This screen allows you to edit a few settings you probably won't need to change
very often, if at all. You can set the minimum SpamAssassin score needed for a piece of mail to be
categorized as low- or high-scoring spam and you can also specify a different e-mail address that
you want as an option to forward low- or high-scoring spam to. Keep in mind that the address
specified here will appear as an option for both high- and low-scoring spam for all domains and
subdomains along with the standard spam@(sub.)domain.com. Be sure to click Change if you
make any changes. The new high- and low-scoring spam settings will take up to 10 minutes to
become active, but the e-mail address you specify here will become an option immediately. | 
Disclaimer