Connect a cPanel / WHM server

Relay all outbound mail from your cPanel/WHM server through MX Sentinel — a drop-in replacement for MailChannels. cPanel keeps DKIM-signing each customer's mail; MX Sentinel relays it across your IP pool, authenticates it, filters outbound abuse, and gives you per-message visibility.

Connection settings

Step 1 — Create one SMTP user

Go to SMTP Users → add a user (a full address like relay@relay.example.com is conventional) and let it suggest a strong password. Your whole cPanel server authenticates with this single credential — you do not create one per customer.

Step 2 — Point WHM / Exim at the relay

In WHM → Service Configuration → Exim Configuration Manager → Advanced Editor, add a router, transport, and authenticator (replace the host, user, and password), then restart Exim. This replaces the MailChannels configuration.

# WHM > Exim Configuration Manager > Advanced Editor

# --- ROUTERS START ---
send_via_mxsentinel:
  driver = manualroute
  domains = ! +local_domains
  transport = mxsentinel_smtp
  route_list = * relay.example.com::587
  no_more

# --- TRANSPORTS START ---
mxsentinel_smtp:
  driver = smtp
  hosts_require_auth = relay.example.com
  hosts_require_tls = relay.example.com

# --- AUTHS START ---
mxsentinel_login:
  driver = plaintext
  public_name = LOGIN
  client_send = : relay@relay.example.com : YOUR_SMTP_PASSWORD

Step 3 — DKIM: nothing to do

cPanel already DKIM-signs each account's mail and publishes the key in the customer's DNS. MX Sentinel passes that signature through untouched, so mail stays authenticated for the customer's own domain (dmarc=pass via DKIM).

Step 4 — Per-domain DNS (SPF + DMARC)

For each sending domain, publish (DKIM is already handled by cPanel):

• SPF (TXT @): add the relay — v=spf1 include:<your SPF endpoint> ~all (set the endpoint under Settings).
• DMARC (TXT _dmarc): v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com — start at p=none, tighten to quarantine/reject later.

To monitor a domain's DNS posture in the dashboard, register it (bulk-import the whole server's list straight from cPanel):

cat /etc/trueuserdomains | mxctl domain import --tenant <slug>

Step 5 — Send a test & verify

From the cPanel box (or anywhere that can reach the relay):

swaks --to you@gmail.com --from test@yourdomain.com \
  --server relay.example.com --port 587 --tls \
  --auth LOGIN --auth-user relay@relay.example.com --auth-password 'YOUR_SMTP_PASSWORD'

• Watch it in Message Explorer (filter by domain or SMTP user).
• Open the received message's headers — confirm spf=pass, dkim=pass, dmarc=pass.

Step 6 — Warm up & monitor

• Warm up new sending IPs: ramp volume gradually over days/weeks — a cold IP that suddenly blasts gets throttled or spam-foldered.
• Domains flags broken SPF/DKIM/DMARC; Incidents surfaces abuse (a customer whose mail recipients reject as spam is auto-flagged), and outbound rate limits cap any single sender — so one compromised account can't burn the shared IP pool.

Outbound spam/malware filtering (rspamd + ClamAV), per-domain rate limits, and random IP rotation are configured on the relay host by the installer — see the project's docs/deploy-relay.md for the relay-side runbook.