# Configure MailScanner
Source: https://docs.webgee.com/en/email/configure-mailscanner





















**MailScanner** filters spam and viruses out of inbound mail before it reaches
your mailboxes. Applies to all cPanel hosting accounts, including reseller
accounts.

It combines several engines: MailScanner itself as the processing core,
SpamAssassin for spam scoring, ClamAV for virus detection, and the DCC and
Vipul's Razor networks for collaborative spam identification.

<img alt="The MailScanner interface in cPanel" src="__img0" />

## Open MailScanner [#open-mailscanner]

1. Log in to cPanel.
2. In the **Mail** section, select **MailScanner**.

   <img alt="The MailScanner icon in cPanel's Mail section" src="__img1" />

The screen has two parts: **Current Settings**, showing what is active now, and
**Change Individual Domain Settings**, where you configure each domain
separately.

<img alt="The MailScanner configuration screen" src="__img2" />

## How spam scoring works [#how-spam-scoring-works]

Every message is given a score. Two thresholds decide what happens to it:

| Score                          | Treated as             |
| ------------------------------ | ---------------------- |
| Below the low threshold        | Normal mail, delivered |
| Between the two thresholds     | Low-scoring spam       |
| At or above the high threshold | High-scoring spam      |

With a low threshold of `5` and a high threshold of `10`, a message scoring 7 is
low-scoring spam and one scoring 12 is high-scoring spam.

You choose separately what happens to each band: **Deliver**, **Delete**, or
**Forward** to an address such as `spam@yourdomain.com`.

<Callout type="warn">
  Do not set either band to **Delete**. Deleted mail is gone — there is nothing
  to release and no way to discover a false positive. Deliver low-scoring spam
  so it lands in the Spam folder, and forward high-scoring spam to a review
  address if you want it out of the way.
</Callout>

## Settings [#settings]

| Setting                    | What it does                                                         |
| -------------------------- | -------------------------------------------------------------------- |
| **Spam Scanning**          | Turns spam scoring on or off                                         |
| **Virus Scanning**         | Turns ClamAV scanning on or off                                      |
| **Deliver Cleaned Emails** | Whether to deliver a message after a virus has been stripped from it |
| **Low Scoring Spam**       | Deliver, delete or forward                                           |
| **High Scoring Spam**      | Deliver, delete or forward                                           |

Leave **Virus Scanning** on. There is no reasonable case for turning it off.

## Whitelist and blacklist [#whitelist-and-blacklist]

<img alt="The spam whitelist and blacklist settings" src="__img3" />

* **Whitelist** — always deliver, regardless of score.
* **Blacklist** — always block.

Both accept a single address, `name@domain.com`, or a whole domain,
`*@domain.com`.

<Callout type="warn">
  Whitelisting a whole domain, especially a large provider like
  `*@gmail.com`, disables filtering for every sender there. Spammers forge
  addresses at exactly those domains. Whitelist individual addresses instead.
</Callout>

Reach for the whitelist when a specific supplier, client or automated system is
being caught repeatedly. Raising the thresholds is the blunt alternative and
lets everything else through too.

## Advanced settings [#advanced-settings]

<img alt="The advanced spam scoring settings" src="__img4" />

Set the low and high thresholds and, optionally, an additional address to
receive forwarded spam.

Lower numbers are stricter. Moving the low threshold from 5 to 3 catches more
spam and also more legitimate mail. Change one threshold at a time and give it a
few days before judging the effect.

## Release held mail with MailControl [#release-held-mail-with-mailcontrol]

**MailControl** lists messages that were flagged and not delivered.

<img alt="The MailControl tool listing held messages" src="__img5" />

Messages are sorted into **Low Spam**, **High Spam**, **Infected** and
**Blacklist**.

1. Select **View/Status** on a message to examine it.

   <img alt="Examining a held message" src="__img6" />

2. If it is not spam, select **Learn as Ham** to teach the filter.

   <img alt="The Learn as Ham action" src="__img7" />

3. To deliver it to the original recipient, select &#x2A;*Release (Direct)**.

   <img alt="The Release (Direct) action" src="__img8" />

Use **Learn as Ham** as well as releasing. Releasing delivers this one message;
teaching the filter reduces how often the same sender is caught again.

<Callout type="warn">
  Never release a message from the **Infected** category. It was held because it
  contains malware, not because it scored badly.
</Callout>

## Verify [#verify]

* Send yourself a message from an outside address and confirm it arrives.
* Check MailControl after a day or two for false positives, and whitelist or
  teach as needed.
* If genuine mail is consistently caught, raise the low threshold slightly
  rather than whitelisting broadly.

## Related [#related]

* [Spam and virus filtering](/en/email/spam-and-virus-filtering)
* [Report a false positive](/en/email/report-a-false-positive)
* [Why your email is marked as spam](/en/email/why-are-my-emails-being-marked-as-spam)