BoxTrapper (Spam Verification) in cPanel

You can use the BoxTrapper tool in cPanel to apply a challenge-response verification filter on an email account, requiring unknown senders to verify before their messages reach your inbox. This is especially useful for reducing spam on high-visibility or personal-email accounts.

Step 1: Access the BoxTrapper Interface

1. Log in to your cPanel account.
2. In the Email section, click BoxTrapper.
3. You will see a list of email accounts and each account’s BoxTrapper status.

Step 2: Enable BoxTrapper for an Email Account

1. Next to the email account you wish to protect, click Manage.
2. On the Manage page, click Enable.

• • Note: Enabling BoxTrapper automatically adds any email address you send to into the whitelist.

Step 3: Configure BoxTrapper Settings

On the BoxTrapper Configuration page you can customise key settings:

Configure Settings

• Email addresses for this account – enter a comma-separated list of forwarder addresses that should bypass verification.
• Your Name – the sender name used in verification emails.
• The number of days to keep logs and messages in the queue – set how long unverified messages and logs are stored.
• Minimum SpamAssassin Spam Score required to bypass BoxTrapper – emails with spam score below this value are delivered automatically.
• Automatically whitelist the To/From lines from whitelisted senders (Whitelist by association) – enable to automatically whitelist addresses that appear in To or CC lines of whitelisted emails.

SpamAssassin Spam Score

BoxTrapper integrates with the SpamAssassin system: if an incoming email’s spam score is lower than your configured threshold, BoxTrapper lets it through without requiring sender verification.

Step 4: Edit Templates & Manage Lists

Edit Confirmation Messages

You can customize the messages that BoxTrapper sends when challenge-response is required:

• verify — sent when a non-whitelisted sender sends you an email.
• verifyreleased — sent when verification is completed successfully.
• returnverify — sent when verification fails.
• blacklist — sent when a blacklisted sender attempts to email you.

Templates use variables such as %email%, %fromname%, %subject%, and %msgid%.

Edit Whitelist, Blacklist & Ignore Lists

You can refine filtering by using the lists:

• Whitelist — senders whose messages are delivered automatically.
• Ignore list — messages from these senders are silently deleted.
• Blacklist — senders get a notification that their message was blocked.

Forward List

If you wish, you can set up one or more email addresses to which verified messages are also forwarded.

Step 5: Monitor Logs & Review Queue

• Review Log – shows daily activity for the BoxTrapper-protected account: who sent an email, whether verification was sent/received.
• Review Queue – shows messages waiting for verification. From here you can manually whitelist or delete entries.

Notes and Best Practices

• Be aware that using BoxTrapper can increase server load and produce backscatter (verification emails sent to spoofed sender addresses).
• It’s best used in combination with SpamAssassin rather than as your only spam defence.
• If you operate a mailing list or expect many first-time contacts (vendors, clients), consider not applying BoxTrapper to that account—otherwise you might block legitimate inbound messages.
• Regularly monitor the review queue. Stale unverified messages can accumulate and use disk space.
• Automated whitelisting (addresses you send to) is useful — but if you disable it, remember to manually whitelist frequent contacts.
• If unsure how to set spam-score thresholds or maintain the review queue, contact Thamara.Cloud Support before enabling BoxTrapper for critical email accounts.

Updated on: 13/11/2025