How to Set Up MailChannels Outbound Filtering on a cPanel Server

MailChannels Outbound Filtering is a relay (a "smart host") for a server's outgoing email. Instead of delivering mail straight to Gmail, Outlook and others, your cPanel server hands every message to MailChannels, which checks it for spam, blocks compromised accounts, and delivers it from IP addresses with a good reputation. Hosting companies use it so that one hacked mailbox does not get the whole server blacklisted. MailChannels

This guide sets it up with the official WHM plugin.

Quick answer

1. As root, run the installer:

   wget https://s3.amazonaws.com/mailchannels-reseller/plugins/mailchannels-cpanel-v3-installer && bash mailchannels-cpanel-v3-installer
   

2. In WHM, search for MailChannels and open the plugin.

3. Under Configuration › API, enter your MailChannels API key.

4. Under Configuration › Outbound, enter your Account ID and SMTP Password.

5. Add include:relay.mailchannels.net to each domain's SPF record, and a _mailchannels Domain Lockdown record.

MailChannels

What you need:

• A MailChannels Outbound Filtering account, with access to its Host Console.
• Root SSH access and WHM on a server running cPanel & WHM version 68 or later. MailChannels
• Access to the DNS of the domains that send mail.

Step 1: Get your details from the Host Console

Log in to the MailChannels Host Console and note three things: MailChannels

• Account ID: shown in the top-right corner. It is also your SMTP username.
• API key: create one under Settings › Account › API Keys.
• SMTP password: create one under Settings › Account › SMTP Passwords.

Keep the API key and SMTP password somewhere safe, such as a password manager.

Step 2: Install the plugin

Before you start: if this server was ever connected to MailChannels by hand (custom routers and transports in the Exim Advanced Editor), remove those first. The plugin and manual settings must not run together. MailChannels

1. Log in to the server over SSH as root.

2. Run the installer:

   wget https://s3.amazonaws.com/mailchannels-reseller/plugins/mailchannels-cpanel-v3-installer && bash mailchannels-cpanel-v3-installer
   

3. Wait for the final line, which says the plugin was installed and gives its version.

If the server has the older v2 plugin, the installer asks to remove it first. Say yes; if you say no, the installer stops. MailChannels

Step 3: Connect the plugin to your account

1. Log in to WHM as root.
2. Type MailChannels in the search box at the top left and click the result. The plugin opens in a new browser tab.
3. Click Configuration in the left menu and open the API section. Paste your API key and click Update.
4. Open the Outbound section. Enter your MailChannels Account ID and SMTP Password, then save.

From now on, the server's outgoing mail goes through MailChannels. Mail between accounts on the same server is still delivered locally. MailChannels

The same plugin also does Inbound filtering (spam filtering for incoming mail). If you only bought Outbound, leave the Inbound section empty.

Step 4: Update SPF and add Domain Lockdown

Receiving servers check a domain's SPF record to see which servers may send its email. Your mail now leaves from MailChannels, so each sending domain needs MailChannels in its SPF record. MailChannels

SPF. Edit the domain's existing SPF TXT record and add include:relay.mailchannels.net before the all at the end:

v=spf1 a mx include:relay.mailchannels.net ~all

Keep one SPF record per domain. Two v=spf1 records make both invalid.

Domain Lockdown. Add a second TXT record so that only your MailChannels account can send for the domain, not other MailChannels customers. Use your Account ID:

MailChannels strongly recommends this record; without it, other MailChannels customers can more easily send email that pretends to come from your domain. MailChannels

The plugin updates SPF for domains whose DNS is on this server, but not for subdomains, and on servers with 1,000 or more domains it may time out before finishing. Domains whose DNS is hosted elsewhere (for example on Cloudflare) always need the change made there by hand. MailChannels

Step 5: Check it works

1. Check the DNS records, replacing the domain with yours:

   dig TXT example.com +short
   dig TXT _mailchannels.example.com +short
   

   The first should include include:relay.mailchannels.net; the second should show v=mc1 auth=…. MailChannels

2. Send a test email from a mailbox on the server to an outside address, such as a Gmail account.

3. Check the server's mail log for the message:

   grep mailchannels /var/log/exim_mainlog | tail
   

   Lines showing smtp.mailchannels.net mean the message went through MailChannels.

4. In Gmail, open the message, choose Show original, and check that SPF and DKIM say PASS.

Troubleshooting

Mail bounces with "message has lines too long for transport". Exim's line length limit also applies to the MailChannels transport. See How to Fix "message has lines too long for transport" on cPanel.

SPF fails at the recipient. The SPF record is missing include:relay.mailchannels.net, there are two SPF records, or the include comes after all. DNS changes can take a while to show everywhere. MailChannels

Mail is rejected by MailChannels. MailChannels may have blocked a sender it thinks is sending spam. Look the message up in the Host Console's log search; the bounce message includes a code that explains why.

Your hosting provider blocks outgoing port 25. MailChannels also accepts port 587 and port 2525 with STARTTLS. MailChannels Ask MailChannels support before changing the plugin's port.

Removing MailChannels. Run the uninstaller as root. When it asks whether to disable Outbound and restore your previous Exim settings, answer yes. Add --purge to also delete its logs and settings. MailChannels

/usr/local/mailchannels/bin/uninstall.sh

Then remove include:relay.mailchannels.net and the _mailchannels record from your DNS.

Without the plugin

If you cannot install the plugin, MailChannels can also be set up by adding an authenticator, a router and a transport in WHM › Service Configuration › Exim Configuration Manager › Advanced Editor. MailChannels publishes the exact blocks for each cPanel version in its cPanel/WHM guide. Export your current Exim configuration first, because a mistake there can stop all email.