How To Force SMTP Authentication In cPanel

In earlier versions of cPanel/WHM, email sending relied on POP-before-SMTP authentication. This meant a user had to log in through POP3 before being allowed to send emails via SMTP—and the access lasted for about 30 minutes.

However, this method is not very secure and can cause email delivery issues. The recommended approach is to force SMTP authentication for all outgoing emails. This ensures only authorized users can send emails, helping prevent spamming and abuse.

Why Enforce SMTP Authentication?

• Better Security: Prevents unauthorized mail relay.

• Reduced Spam Risk: Stops spammers from using your server without login.

• Compliance: Aligns with modern email security standards like SPF, DKIM, and DMARC.

• Improved Deliverability: ISPs trust emails sent via authenticated SMTP.

Steps to Force SMTP Authentication in cPanel

1. Log in to the Server via SSH

Connect to your cPanel/WHM server as the root user:

ssh root@your-server-ip

2. Disable POP-before-SMTP

Run the following command:

/usr/local/cpanel/bin/tailwatchd –disable=Cpanel::TailWatch::Antirelayd

This disables the old Antirelayd service, which allowed POP-before-SMTP authentication.

3. Enable SMTP Authentication

Once Antirelayd is disabled, SMTP authentication becomes the default. All users will now need to authenticate with their email credentials before sending mail.

4. Restart Mail Services

Restart Exim (the mail server used in cPanel) to apply changes:

/scripts/restartsrv_exim

Verify SMTP Authentication

To confirm authentication is working:

1. Configure your email client (Outlook, Thunderbird, etc.) with your cPanel email credentials.

2. Ensure “My outgoing server requires authentication” is enabled in settings.

3. Send a test email. If successful, authentication is enforced.

Forcing SMTP authentication in cPanel enhances your server’s security and ensures only authorized users send mail. By disabling Antirelayd and enabling default SMTP authentication, you can reduce spam risk and improve your email deliverability.