How to Create Email Filters in cPanel (Account and User Level)

cPanel gives you two separate places to build a mail filter, and picking the wrong one is the most common reason a rule seems to do nothing. Global Email Filters, under the Email section of cPanel, apply to every mailbox on the domain — new accounts included. Email Filters, opened per mailbox, only touch that one account.

Both use the identical rule builder: a condition (which header to check, how to match it) and one or more actions (what to do when it matches). The difference is only where the rule lives and how far it reaches.

Account-level vs. user-level filters: which one do you need?#

Use a global (account-level) filter when the rule should apply no matter which mailbox on the domain receives the mail — blocking a sender domain entirely, or discarding anything that fails your outbound rules, for example. Use a user-level filter when only one mailbox needs the behavior, such as auto-filing invoices for the accounting address without touching support@ or sales@.

A subtlety worth knowing: global filters run before mail is handed off to the individual account, so a global "discard" removes a message before any per-user filter, spam setting, or webmail rule ever sees it. If a message you expected in a specific mailbox is missing entirely, check the global filter list first — it's invisible from inside that one account's settings.

• Global Email Filters — Email section of cPanel, applies to the whole domain, useful for blocklists and domain-wide policy
• Email Filters (per account) — opened via "Manage Filters" next to one address, applies to that mailbox only
• Global filters evaluate first; a discard or fail there means the per-user filter list never runs

Before you start#

Know which of the two you're building before you open the interface — the account picker for global filters is labeled differently from the per-user "Manage Filters" link, and it's easy to end up in the wrong one.

Decide your action in advance. Filters that discard mail don't notify anyone, including you — a mistyped condition can silently drop legitimate mail for weeks before anyone notices. Start with a narrower action (redirect to a folder, or fail with a clear bounce) while you're still confirming the rule matches what you expect.

Steps: creating a filter in cPanel#

1. 1

   Open the right filter list

   In cPanel, go to Email > Global Email Filters for a domain-wide rule, or Email > Email Filters, then "Manage Filters" next to the specific mailbox for a per-account rule.

2. 2

   Name the rule and set the first condition

   Choose the header to inspect (From, Subject, To, Body, or a custom header), a match type (contains, equals, matches regex, does not contain), and the value to match against.

3. 3

   Add more conditions if needed

   Combine conditions with "and" or "or" for rules like "From contains @spamdomain.com AND Subject contains invoice."

4. 4

   Choose one or more actions

   Pick from: Discard Message, Fail Message (bounce with a custom error), Redirect to Email, Redirect to Folder, Stop Processing Rules, or Pipe to a Program.

5. 5

   Save and confirm the rule is active

   The new rule appends to the bottom of the list and runs after existing rules, in order, top to bottom. Drag rules to reorder them if a later rule needs to run before an earlier one.

6. 6

   Test it before you trust it

   Use the Filter Test box on the same screen: paste a sample raw message (headers plus body) and run "Test Filter" to see the Filter Trace Results — which conditions evaluated true or false, and what the resulting delivery action would be.

Global vs. user-level filters: a side-by-side comparison#

How does the discard action differ from fail message?#

Discard Message deletes the mail with no trace: no bounce to the sender, no entry in the recipient's inbox, no notification anywhere. It's the right choice once you're confident a rule is correct — for a known spam pattern, for example — but it's also the action most likely to hide a mistake, because a wrong condition just makes mail disappear rather than throwing an error you'd notice.

Fail Message rejects the mail with a bounce back to the sender, and you can set the bounce text. That makes it the safer default while you're still testing: a legitimate sender who trips the rule gets an error message instead of silence, and you find out about the false positive.

What does "pipe to a program" do, and when would you use it?#

Pipe to a Program hands the raw message to a script or binary on the server instead of delivering it normally — the mail becomes that program's standard input. It's built for server-side automation: feeding messages into a custom parser, a ticketing system's mail intake, or a logging script.

It is also the action most likely to break silently. If the script path is wrong, the script isn't executable, or the script exits with a non-zero status, the message can be lost with nothing in the mailbox to show for it. Confirm the target script's permissions and test with a throwaway message before pointing a live filter at it.

What to do when a cPanel email filter doesn't work#

Most "my filter isn't working" reports come down to one of a handful of causes. Work through them in order before assuming the feature is broken.

A faster way: filtering without hand-writing rules per mailbox#

cPanel's filter builder is precise, but it's manual — every new pattern is a rule you write, place in the right order, and re-test by hand, and a rule that made sense for one client's inbox often needs rebuilding for the next. AI Emaily connects to any IMAP mailbox, including cPanel-hosted email, and applies rules continuously through its Rules + Context Brain: instead of a static condition list, it files, labels, and routes mail based on the sender, the thread, and the pattern it's learned you care about — with approval-before-send and an undo/audit trail on anything it acts on. We build AI Emaily. It doesn't replace the mail server's own filters — those still belong in cPanel — but it's the layer that keeps working on the inbox once mail lands, without you re-authoring a filter every time your triage needs shift.