Prevent PHP Mail() from sending mails from identified emails

[jk_dc]

Hello

We have been facing alot of email spam issues and have been following logs to suspend/notify customers about email spamming from their account.

We are looking for the following optimizations on our server to prevent compromised code to even generate email - here are the questions:

1) Is there a way to prevent/block emails that being sent using php mail function if "to" email account is already created in cPanel - idea is to block all such request where unidentified emails are being used to send out spam.

2) Any way to let PHP mail function send emails to email accounts existing within cPanel? - this is way if a contact form uses php mail, we will ask user to and from email that exist in cPanel.

I am aware that we can block php mail functions entirely and use SMTP for the mails, this is going to break alot of end user codes and will be a mess at this time for us - so we are trying to find around other solutions that can help us prevent spam.

3) What is the best practices being used by web hosting providers here? Do they keep php mail functions enabled? If yes, what are the best precautions to be followed.

Thanks in advance for the help - looking forward to hear back.

 

[cPanelMichael]

Hello @jk_dc,

The following documents offer useful advice if you have not already read them:

How to Prevent Email Abuse - cPanel Knowledge Base - cPanel Documentation
How to Prevent Spam with Mail Limiting Features - cPanel Knowledge Base - cPanel Documentation

You may also find some of the information on the following thread helpful:

SOLVED - How to prevent all cPanel PHP mail() to be sent from server hostname?

In terms of controlling the type of emails allowed through the PHP Mail function, you might be able to do this with a custom Exim system filter rule. I don't have an example to offer, but theoretically you could develop a rule that checks for specific aspects of the message header (to detect messages sent via the PHP Mail function) and then if/then scenarios that block the emails if certain conditions are met. This level of rule is outside our scope of support, but the Exim User's mailing list is often a useful resource.

I am aware that we can block php mail functions entirely and use SMTP for the mails, this is going to break alot of end user codes and will be a mess at this time for us - so we are trying to find around other solutions that can help us prevent spam.

While it might involve more work at the beginning, working with your customers to have them use SMTP authentication is likely the better long-term approach. Most of the popular PHP scripts (e.g. WordPress) offer methods to force the use of SMTP authentication.

Thank you.