How to Set Up Spam Protection for Email on Shared Hosting

This guide shows you how to reduce spam in your email accounts on a shared hosting plan. You’ll learn how to enable the built-in spam filters, set up SPF, DKIM, and DMARC records, and use client-side rules to catch what slips through. You’ll need access to your hosting control panel (cPanel, Plesk, or similar) and the ability to edit DNS records.

What You’ll Need

• Access to your hosting control panel (usually cPanel or Plesk).
• Your domain’s DNS management page (often inside the same control panel).
• An email client (like Outlook, Thunderbird, or webmail) to create filtering rules.
• Basic knowledge of DNS records (A, MX, TXT).

Step-by-Step

1. Log in to your hosting control panel. Go to your hosting provider’s login page and enter your credentials. Look for a section labeled “Email,” “Mail,” or “Domain.”
2. Enable the built-in spam filter. Most shared hosts include a server-side spam filter (like SpamAssassin). In cPanel, find “Email Deliverability” or “Spam Filters.” In Plesk, look under “Mail” > “Spam Filter.” Enable it and set the sensitivity level (usually “High” or “Aggressive”). Save changes.
3. Check your email routing. Ensure that incoming mail is being routed to the correct mail server. In cPanel, go to “MX Entry” and confirm it points to your domain’s mail server (e.g., mail.yourdomain.com). If you use a third-party email service (like Google Workspace), make sure the MX records point there.
4. Set up SPF (Sender Policy Framework). Add a TXT record in your DNS zone. The record should look like: v=spf1 +a +mx -all. This tells receiving servers that only your domain’s A record and MX servers are allowed to send email. Save the record.
5. Set up DKIM (DomainKeys Identified Mail). In cPanel, go to “Email Deliverability” and click “Manage” next to your domain. If DKIM is not already enabled, click “Enable.” Copy the generated DKIM record (usually a TXT record with a name like default._domainkey). If the system doesn’t add it automatically, add it manually in your DNS zone.
6. Set up DMARC (Domain-based Message Authentication, Reporting & Conformance). Add a TXT record with the name _dmarc.yourdomain.com and the value: v=DMARC1; p=none; rua=mailto:you@yourdomain.com. Start with p=none to monitor, then later change to p=quarantine or p=reject once you’re sure legitimate mail passes.
7. Create email filters in your client. Even with server-side filters, some spam gets through. In webmail (like Roundcube or Horde) or a desktop client, create a rule that moves messages with “spam” in the subject or from unknown senders to a “Junk” folder. For example, in Gmail (if you use it), create a filter that sends messages with “unsubscribe” in the body to spam.
8. Test your setup. Send a test email from an external account (like Gmail) to your domain email. Check if it lands in the inbox or spam folder. Also, send a test from your domain to an external address and check that SPF and DKIM pass (you can view headers in the receiving client).
9. Monitor and adjust. After a week, check your spam folder for false positives (legitimate mail marked as spam). Adjust the spam filter sensitivity if needed. Also, review DMARC reports (if you set rua=) to see if any legitimate sources are failing authentication.

Common Mistakes

• Setting DMARC to “reject” too early. If you haven’t fully configured SPF and DKIM, legitimate mail may be rejected. Always start with p=none.
• Using a too-strict SPF record. -all means “fail” for any server not listed. If you use a third-party email service, make sure to include their servers (e.g., include:_spf.google.com).
• Forgetting to enable DKIM. Many hosts leave DKIM disabled by default. Without it, your emails are more likely to be flagged as spam.
• Not checking the spam folder. Server-side filters can be too aggressive. Regularly check your spam folder for false positives.
• Ignoring DNS propagation time. DNS changes can take up to 48 hours to take effect. Don’t panic if authentication fails immediately after adding records.

Tips

• Use a dedicated email address for spam traps. Create an address like spam@yourdomain.com and use it when signing up for newsletters. Then you can easily filter all mail to that address.
• Enable greylisting if available. Some hosts offer greylisting, which temporarily rejects mail from unknown senders. Legitimate servers retry, while spam bots often don’t.
• Keep your CMS and plugins updated. If you use WordPress, outdated plugins can send spam from your domain, damaging your sender reputation.
• Use a separate domain for bulk email. If you send newsletters, use a subdomain like mail.yourdomain.com and set up SPF/DKIM for that subdomain. This protects your main domain’s reputation.
• Regularly review your DNS records. Ensure no extra records have been added (e.g., by a malicious script) that could weaken your security.

Troubleshooting

• Legitimate emails go to spam. First, check your SPF and DKIM records using an online tool (e.g., MXToolbox). If they pass, lower the spam filter sensitivity. Also, ask the sender to add you to their contacts or whitelist.
• Spam still arrives in the inbox. Increase the spam filter sensitivity. Also, create a rule in your client that sends messages with common spam words (e.g., “viagra,” “lottery”) to the trash. Check if your host offers a “spam box” that you can enable.
• Emails bounce or get rejected. If you set DMARC to p=reject and legitimate mail is failing, change it back to p=none immediately. Also, check your SPF record for typos (e.g., missing v=spf1).
• DKIM not working. Ensure the DKIM record is published correctly. In cPanel, the “Email Deliverability” page shows the exact record to add. If you added it manually, check the name (e.g., default._domainkey) and the value (it should start with v=DKIM1; k=rsa; p=).
• Changes not taking effect. DNS changes can take up to 48 hours. Use a tool like dig or online DNS checker to see if the records are visible. If they are, but mail still fails, contact your hosting support.

Frequently Asked Questions

What is the difference between SPF, DKIM, and DMARC?

SPF verifies that the sending server is authorized by the domain. DKIM adds a digital signature to the email. DMARC tells receiving servers what to do if SPF or DKIM fail. Together they authenticate your email and help prevent spoofing.

Will enabling spam filters block legitimate email?

Sometimes, but you can adjust the sensitivity. Start with a moderate level and check your spam folder regularly. If you find false positives, add senders to your whitelist or lower the sensitivity.

Do I need to set up SPF, DKIM, and DMARC if I only use webmail?

Yes. These records are used by receiving servers to verify your domain. Without them, your emails are more likely to be marked as spam, even if you send from webmail.

Can I use a third-party spam filter on shared hosting?

Yes, you can route your email through a service like SpamTitan or MailScanner, but this requires changing MX records and may involve additional costs. Most shared hosts include a basic filter that is sufficient for most users.

How long does it take for spam filter settings to take effect?

Server-side spam filter settings (like SpamAssassin) usually take effect immediately. DNS-based records (SPF, DKIM, DMARC) can take up to 48 hours to propagate.

What if I use a third-party email service like Google Workspace?

You should disable the hosting’s mail server and point your MX records to the third-party service (e.g., Google’s MX records). Then, set up SPF and DKIM within that service’s admin panel. Your hosting’s spam filter won’t apply to external mailboxes.

Related

• Party Games: Why Everyone Should Try Them
• 5 Retro Gadgets That Still Just Work Today
• Canva Design Tricks to Make Graphics Pop