Configuring Email Filters and Forwarders in cPanel

Forwarders vs filters: what each one does

cPanel’s Email section includes two tools that are easy to confuse. A forwarder is a simple routing rule: mail sent to one address is delivered to another address, optionally as well as the original mailbox. A filter is a conditional rule: it examines each incoming message and, if the conditions match, performs an action such as moving it to a folder, discarding it or redirecting it.

Used well, these tools let a small team share inboxes, route support mail, keep spam out of the way and send messages into scripts. Used carelessly, they can silently lose mail, create loops or damage your domain’s sending reputation. This guide covers both, with the settings worth getting right.

Setting up an email forwarder

Open Email > Forwarders and choose Add Forwarder.

1. Enter the address to forward, for example sales@example.com. The address does not need its own mailbox.
2. Choose a destination. The usual option is Forward to Email Address; you can add several destinations by creating multiple forwarders for the same address.
3. Click Add Forwarder.

If sales@example.com also exists as a mailbox, messages are delivered to both the mailbox and the forwarding target. If it exists only as a forwarder, mail goes straight to the destination and no copy is kept on the server.

Advanced destinations

• Discard and send an error to the sender: rejects mail with a message you write, useful for retired addresses.
• Forward to a system account: available on some servers for administrative use.
• Pipe to a program: passes the raw message to a script, for example a ticketing system parser.
• Discard (not recommended): drops mail silently, so senders never learn it was not received.

Domain-level forwarding and the default address

The same Forwarders page has a Add Domain Forwarder option. This redirects all mail for one domain to the same local part on another domain, so anything@old-brand.com becomes anything@new-brand.com. It is handy after a rebrand, as long as both domains are on the account.

Separately, Email > Default Address controls what happens to mail sent to addresses that do not exist on the domain. You can send it to a mailbox (often called a catch-all) or reject it. Catch-alls tend to attract large volumes of spam sent to random addresses, and if the catch-all forwards externally, that spam is relayed with your server’s name on it. For most sites, rejecting unknown addresses is the safer default.

Creating email filters

Filters come in two scopes:

• Email Filters (user-level): apply to one mailbox. Users can often manage these through webmail too.
• Global Email Filters: apply to all mail arriving for the cPanel account, before per-mailbox rules.

To create a filter, open the relevant page, choose the account if needed, and click Create a New Filter. Each filter has a name, one or more rules and one or more actions.

Rules

A rule combines a field, an operator and a value. Common fields include From, Subject, To, Reply Address, Body, Any Header, Any Recipient and Spam Status or Spam Score when spam scanning is enabled. Operators include contains, does not contain, equals, begins with, ends with and matches regex. You can chain rules with and or or.

Actions

Typical actions are Deliver to Folder, Redirect to Email, Discard Message, Fail with Message, Stop Processing Rules and Pipe to a Program. Filters run in order, so a broad rule near the top can catch messages you intended for a more specific rule further down.

Practical filter recipes

The spam rule is one of the most useful global filters, because it keeps flagged mail available for review rather than deleting it. Prefer Fail with Message over Discard for blocks so legitimate senders caught by mistake get a bounce they can act on.

Behind the scenes, cPanel stores filters as Exim filter files. A user-level spam rule typically looks like this:

if
 $header_X-Spam-Status: begins "Yes"
then
 save "$home/mail/example.com/info/.spam/"
endif

You do not need to edit these files directly, and on most servers you should not, but recognising the format helps when reading the test output.

Forwarding, SPF, DMARC and deliverability

Forwarding mail to Gmail, Outlook.com or another provider is popular, but it has a structural problem. When your server forwards a message from someone@bank.example, the receiving provider sees it arriving from your server’s IP address. That IP is not listed in the original sender’s SPF record, so SPF can fail, and if the sender publishes a strict DMARC policy the forwarded message may be rejected or sent to spam.

Forwarding spam is worse: the receiving provider may attribute the junk to your server, which can affect delivery of your own outgoing mail.

• Keep forwards to a minimum, and prefer collecting mail with IMAP or POP3 in the destination client where possible.
• Ask your host about SRS (Sender Rewriting Scheme), which rewrites the envelope sender so SPF checks pass on forwarded mail. It is a server-level setting in WHM.
• Filter spam before forwarding, using a global filter that delivers spam to a local folder and stops processing.
• Publish SPF, DKIM and DMARC for your own domain under Email > Email Deliverability, so mail you send is authenticated.

If your mail suddenly stops arriving, check that the domain itself is still active and pointing to the right server. A quick TLDix WHOIS lookup shows the registration status, expiry date and name servers, which rules out the most basic causes before you start debugging filters.

Piping mail to scripts

Piping hands each message to a program on the server. Ticket systems and custom integrations use it to turn emails into records. In cPanel, the path is entered relative to your home directory:

|/usr/local/bin/php -q /home/acct/helpdesk/pipe.php

Make sure the script is executable, starts with a correct shebang line if called directly, and produces no output. Any output is usually treated as an error and returned to the sender as a bounce. Keep piped scripts outside public_html and validate input carefully, because the content comes from anyone who can send you mail.

Testing and troubleshooting your rules

Both filter pages include a Test Filter box. Paste a full message including headers, or a simple header block, and cPanel shows which rules match and what action would be taken, without delivering anything.

From: billing@supplier.example
To: info@example.com
Subject: Invoice 1042

Test body

After testing, send real messages from an outside account to confirm end-to-end delivery. Useful checks when something goes wrong:

• Track Delivery in the Email section shows whether a message was accepted, forwarded, filtered or rejected, and why.
• Look for loops, such as A forwarding to B while B forwards back to A. Mail servers detect and stop these, but messages bounce.
• Check rule order if a filter never seems to fire; an earlier rule may already have redirected or stopped the message.
• Review discard rules first when mail goes missing without bounces.
• Folder names must match existing IMAP folders, such as INBOX.Invoices; create them in webmail first.

Keeping rules maintainable

Filters and forwarders tend to pile up over the years. Staff leave, campaigns end and suppliers change, yet the rules stay in place and keep moving mail around. Schedule a review every few months:

• List every forwarder and confirm the destination address still belongs to someone who needs the mail.
• Remove forwards to former employees’ personal addresses, which can leak business information.
• Give filters descriptive names, such as “Supplier invoices to folder”, rather than “Filter 3”.
• Check that piped scripts still exist on disk; a missing script causes every matching message to bounce.

For broader context on hosting-side mail setup, see our article on shared hosting configurations. Document every forwarder and filter you create, with who requested it and why, so the next person can safely clean them up.