How to add an IP address as Blacklisted SMTP IP address via WHM?

Overview

The Blacklisted SMTP IP addresses setting in WHM's Exim Configuration Manager allows you to block specific IP addresses from sending mail through your server. Any mail originating from a blacklisted IP will be rejected during the SMTP transaction. This is useful for permanently blocking known spam sources, abusive hosts, or any IP address that should not be allowed to relay mail through your server.

Step 1: Log in to WHM

Log in to your WHM interface as the root user. You can access WHM by navigating to https://your-server-ip:2087 in your browser.

Step 2: Open the Exim Configuration Manager

In the WHM sidebar, navigate to:

Home » Service Configuration » Exim Configuration Manager

Step 3: Switch to the Basic Editor

Click the Basic Editor tab at the top of the page if it is not already selected.

Step 4: Locate the Access Lists Section

Scroll down or use the search box to find the Access Lists section. Within this section, locate the option labeled Blacklisted SMTP IP addresses.

Step 5: Add the IP Address

Click the Edit button next to Blacklisted SMTP IP addresses. In the popup that appears, enter the IP address you want to block. You can add multiple IP addresses, one per line. CIDR notation (e.g., 192.0.2.0/24) is supported for blocking entire ranges.

Step 6: Save and Apply

Click Save in the popup box, then click Save at the bottom of the Exim Configuration Manager page to apply your changes. The server will rebuild the Exim configuration automatically.

Important Notes

• Root access required — Only root-level users can modify Exim configuration settings.
• Takes priority — If an IP address appears on both the trusted and blacklisted lists, the blacklisted setting takes priority and the IP will be blocked.
• Use RBLs for broad blocking — For blocking known spam sources at scale, consider using Realtime Blackhole Lists (RBLs) instead of manually maintaining a blacklist. The Exim Configuration Manager provides RBL settings under the ACL Options section.
• CIDR notation — You can specify IP ranges using CIDR notation (e.g., 203.0.113.0/24) instead of listing individual addresses.
• Check before blocking — Always verify that the IP address you intend to block is genuinely malicious. Accidentally blocking a legitimate mail server can cause email delivery failures.

Troubleshooting

• Changes not taking effect — After saving, you may need to restart Exim by running service exim restart via SSH or WHM Terminal.
• Need to unblock an IP — Return to the same setting, click Edit, remove the IP address from the list, and save again.
• Verify rejection — Check the Exim mail log at /var/log/exim_mainlog to confirm that connections from the blacklisted IP are being rejected. Look for entries mentioning "is blacklisted."

For the official cPanel documentation, visit the Exim Configuration Manager - Basic Editor page.