In this post we are going to setup Exim to add “[External]” to the email subject if it originates from outside of the domain.

Thanks to Sam for this post. It was extremely helpful.
https://tech.saqr.org/2020/01/for-incoming-email-not-from-our-domain.html

ℹ️Exim filters do not appear to allow you to manipulate the body of an email, to do that you would need to use something like altermime.

Steps

1. Create a new Exim Filter
2. Enable Filter

Create an Exim Filter

SSH to the server and create a Exim filter. In cPanel there are in /usr/local/cpanel/etc/exim/sysfilter/options/. You can name the filter what ever you want.

vi /usr/local/cpanel/etc/exim/sysfilter/options/external_email_warning

Change “incredigeek.com” to your domain name.
You can also change “[External]” to whatever you want to be prepended to the subject.

if
  $header_to: contains "@incredigeek.com>"
  and $sender_address: does not contain "@incredigeek.com>"
  and $header_subject: does not contain "[External]"
then
  headers add "Old-Subject: $h_subject:"
  headers remove "Subject"
  headers add "Subject: [External] $h_old-subject"
  headers remove "Old-Subject"
endif

Save the file.

You can replace $sender_address with $header_from. While both can technically be forged, sender_address refers to the envelope sender provided by the SMTP MAIL FROM command and is harder to spoof if SPF is set up. header_from can be spoofed by just about any email client by change the from name.

Enable Custom Exim Filter

Now log into WHM, go to Service Configuration > Exim Configuration Manager > Basic Editor > Filters

At the bottom of the filters, you should see a new “Custom Filter: external_email_filter”
This is the filter you just created. Make sure it is On, and Save changes.

There you go! Any email you receive now that is from an external domain should now have “[External]”, or whatever you specified, prepended to the subject.

If you run into any errors, try reviewing the panic log to see if there are any syntax errors.

Troubleshooting

You can use tail to follow the panic log to verify you have all the syntax correct.

tail /var/log/exim_paniclog -f

More Information and Links

How to Customize the Exim System Filter File.
https://docs.cpanel.net/knowledge-base/email/how-to-customize-the-exim-system-filter-file

Exim Filter Files.
https://www.exim.org/exim-html-current/doc/html/spec_html/filter_ch-exim_filter_files.html

Manage custom, server-wide Exim filters in cPanel.
https://support.cpanel.net/hc/en-us/articles/4402464439447-How-to-manage-custom-server-wide-Exim-filters-in-cPanel-and-how-to-quickly-enable-and-disable-them-in-the-WHM-UI