{"id":5902,"date":"2024-12-09T22:49:00","date_gmt":"2024-12-10T04:49:00","guid":{"rendered":"https:\/\/www.incredigeek.com\/home\/?p=5902"},"modified":"2025-05-14T14:04:25","modified_gmt":"2025-05-14T19:04:25","slug":"add-warning-for-emails-from-external-domains-in-cpanel-whm","status":"publish","type":"post","link":"https:\/\/www.incredigeek.com\/home\/add-warning-for-emails-from-external-domains-in-cpanel-whm\/","title":{"rendered":"Add warning for emails from external domains in cPanel\/WHM"},"content":{"rendered":"\n<p>In this post we are going to setup Exim to add &#8220;[External]&#8221; to the email subject if it originates from outside of the domain.<\/p>\n\n\n\n<p>Thanks to Sam for this post. It was extremely helpful.<br><a href=\"https:\/\/tech.saqr.org\/2020\/01\/for-incoming-email-not-from-our-domain.html\">https:\/\/tech.saqr.org\/2020\/01\/for-incoming-email-not-from-our-domain.html<\/a><\/p>\n\n\n\n<p><em>\u2139\ufe0fExim filters do not appear to allow you to manipulate the body of an email, to do that you would need to use something like <a href=\"https:\/\/www.incredigeek.com\/home\/adding-email-disclaimer-for-entire-domain-on-whm-cpanel\/\">altermime<\/a>.<\/em><\/p>\n\n\n\n<p><strong>Steps<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Create a new Exim Filter<\/li>\n\n\n\n<li>Enable Filter<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Create an Exim Filter<\/h2>\n\n\n\n<p>SSH to the server and create a Exim filter.  In cPanel there are in <code>\/usr\/local\/cpanel\/etc\/exim\/sysfilter\/options\/<\/code>. You can name the filter what ever you want.  <\/p>\n\n\n\n<pre class=\"wp-block-code has-dark-gray-background-color has-background\"><code class=\"\">vi \/usr\/local\/cpanel\/etc\/exim\/sysfilter\/options\/external_email_warning<\/code><\/pre>\n\n\n\n<p>Change &#8220;incredigeek.com&#8221; to your domain name.<br>You can also change &#8220;[External]&#8221; to whatever you want to be prepended to the subject.<\/p>\n\n\n\n<pre class=\"wp-block-code has-dark-gray-background-color has-background\"><code class=\"\">if\n  $header_to: contains \"@incredigeek.com>\"\n  and $sender_address: does not contain \"@incredigeek.com>\"\n  and $header_subject: does not contain \"[External]\"\nthen\n  headers add \"Old-Subject: $h_subject:\"\n  headers remove \"Subject\"\n  headers add \"Subject: [External] $h_old-subject\"\n  headers remove \"Old-Subject\"\nendif<\/code><\/pre>\n\n\n\n<p>Save the file.<\/p>\n\n\n\n<p>You can replace <code>$sender_address<\/code> with <code>$header_from<\/code>.  While both can technically be forged, <code>sender_address<\/code> refers to the envelope sender provided by the SMTP MAIL FROM command and is harder to spoof if SPF is set up.  <code>header_from<\/code> can be spoofed by just about any email client by change the from name.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Enable Custom Exim Filter<\/h2>\n\n\n\n<p>Now log into WHM, go to Service Configuration &gt; Exim Configuration Manager &gt; Basic Editor &gt; Filters<\/p>\n\n\n\n<p>At the bottom of the filters, you should see a new &#8220;Custom Filter: external_email_filter&#8221;<br>This is the filter you just created.  Make sure it is On, and <strong>Save<\/strong> changes.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2024\/12\/image.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1018\" height=\"672\" src=\"https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2024\/12\/image.png\" alt=\"Enable Custom Exim Email Filter for External Email\" class=\"wp-image-5903\" srcset=\"https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2024\/12\/image.png 1018w, https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2024\/12\/image-300x198.png 300w, https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2024\/12\/image-768x507.png 768w, https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2024\/12\/image-454x300.png 454w\" sizes=\"auto, (max-width: 1018px) 100vw, 1018px\" \/><\/a><\/figure>\n\n\n\n<p>There you go!  Any email you receive now that is from an external domain should now have &#8220;[External]&#8221;, or whatever you specified, prepended to the subject.  <\/p>\n\n\n\n<p>If you run into any errors, try reviewing the panic log to see if there are any syntax errors.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Troubleshooting<\/h2>\n\n\n\n<p>You can use tail to follow the panic log to verify you have all the syntax correct.<\/p>\n\n\n\n<pre class=\"wp-block-code has-dark-gray-background-color has-background\"><code class=\"\">tail \/var\/log\/exim_paniclog -f<\/code><\/pre>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">More Information and Links<\/h2>\n\n\n\n<p>How to Customize the Exim System Filter File.<br><a href=\"https:\/\/docs.cpanel.net\/knowledge-base\/email\/how-to-customize-the-exim-system-filter-file\">https:\/\/docs.cpanel.net\/knowledge-base\/email\/how-to-customize-the-exim-system-filter-file<\/a><\/p>\n\n\n\n<p>Exim Filter Files.<br><a href=\"https:\/\/www.exim.org\/exim-html-current\/doc\/html\/spec_html\/filter_ch-exim_filter_files.html\">https:\/\/www.exim.org\/exim-html-current\/doc\/html\/spec_html\/filter_ch-exim_filter_files.html<\/a><\/p>\n\n\n\n<p>Manage custom, server-wide Exim filters in cPanel.<br><a href=\"https:\/\/support.cpanel.net\/hc\/en-us\/articles\/4402464439447-How-to-manage-custom-server-wide-Exim-filters-in-cPanel-and-how-to-quickly-enable-and-disable-them-in-the-WHM-UI\">https:\/\/support.cpanel.net\/hc\/en-us\/articles\/4402464439447-How-to-manage-custom-server-wide-Exim-filters-in-cPanel-and-how-to-quickly-enable-and-disable-them-in-the-WHM-UI<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this post we are going to setup Exim to add &#8220;[External]&#8221; to the email subject if it originates from outside of the domain. Thanks to Sam for this post. It was extremely helpful.https:\/\/tech.saqr.org\/2020\/01\/for-incoming-email-not-from-our-domain.html \u2139\ufe0fExim filters do not appear to &hellip; <a href=\"https:\/\/www.incredigeek.com\/home\/add-warning-for-emails-from-external-domains-in-cpanel-whm\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[195,3],"tags":[196,1718,1262,223,1717,1048,1719,1716,1346,7,382],"class_list":["post-5902","post","type-post","status-publish","format-standard","hentry","category-cpanel","category-linux","tag-cpanel-2","tag-custom-filter","tag-disclaimer","tag-email","tag-email-warning","tag-exim","tag-exim-custom","tag-external-email","tag-filter","tag-linux-2","tag-whm"],"_links":{"self":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/5902","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/comments?post=5902"}],"version-history":[{"count":6,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/5902\/revisions"}],"predecessor-version":[{"id":5986,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/5902\/revisions\/5986"}],"wp:attachment":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/media?parent=5902"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/categories?post=5902"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/tags?post=5902"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}