Route cPanel outbound mail via SES, SendGrid, or Mailgun

Once a shared cPanel server has been listed on Spamhaus or UCEPROTECT enough times, removing the listings stops working — the IP's reputation is sunk and you are better off routing outbound mail through a service that owns clean address space. Amazon SES, SendGrid, and Mailgun all do this; the configuration on the cPanel side is the same shape for each.

This walks through adding a smart host to Exim via WHM's Advanced Editor, authenticating to the provider, restricting which domains use the relay, and the queue inspection that tells you whether mail is actually leaving the box the way you intended. If your problem is volume rather than reputation, start with the Exim outbound throttling guide — that fixes the cause and this article fixes the symptom.

When a smart host is the right answer

A smart host doesn't fix abuse — it just moves whose abuse desk hears about it. Keep your per-account hourly cap and outbound SpamAssassin pass in place; SES will suspend your sending identity within hours if you start relaying spam through them, and that is a worse outage than a Spamhaus listing.

Pick the credentials before touching Exim

Each provider's smart host endpoint and SMTP credentials:

Generate these in the provider's console first. For SES, the IAM SMTP credentials are not your regular IAM access keys — use the Create SMTP Credentials button in the SES console, which derives a Sigv4 password from a fresh IAM user. Note the region; SES endpoints are regional and us-east-1 credentials will not authenticate against eu-west-1.

You also need at least one verified sending identity at the provider — either a domain (DKIM-verified via DNS, the right answer for a hosting fleet) or each individual From: address. Without that, the smart host will accept the SMTP session and then reject the MAIL FROM line, which surfaces in your queue as host email-smtp.… refused MAIL FROM.

Add the smart host in WHM

WHM → Service Configuration → Exim Configuration Manager → Advanced Editor. There are three sections to edit; everything else stays untouched.

1. Authenticator (AUTH section)

Add inside the Auths Configuration block, under the existing auth_relay_hosts section if there is one:

smarthost_login:
  driver = plaintext
  public_name = LOGIN
  hide client_send = : SMTP_USERNAME : SMTP_PASSWORD

The leading colon is intentional — it sends an empty AUTH ID and then username, password. hide keeps the credentials out of the exim debug log. Substitute the real values from the table above; for SendGrid the username is literally apikey.

2. Smart host router (PREROUTERS)

In Routers Configuration → PREROUTERS, add:

send_via_smarthost:
  driver = manualroute
  domains = ! +local_domains
  ignore_target_hosts = 127.0.0.0/8
  transport = smarthost_smtp
  route_list = * email-smtp.eu-west-1.amazonaws.com::587
  no_more

domains = ! +local_domains means "every domain except those hosted on this box" — local mail still routes locally, only outbound goes through the smart host. The no_more prevents Exim from falling back to direct MX delivery if the smart host fails, which is usually what you want (a queued retry through the smart host is safer than punching out to the wider internet).

3. Transport (POSTTRANSPORTS)

In Transports Configuration → POSTTRANSPORTS:

smarthost_smtp:
  driver = smtp
  hosts_require_auth = *
  hosts_require_tls = *
  port = 587
  helo_data = $primary_hostname

hosts_require_tls enforces STARTTLS — SES, SendGrid, and Mailgun all require it and will fail the session otherwise. helo_data sends your real hostname; some providers log it for abuse correlation.

Save. WHM validates the config and restarts Exim. If the parser complains, the most common cause is indentation — Exim configs are whitespace-sensitive and tabs vs spaces matter inside option blocks.

Verify the routing

Send a test from the command line as a real user, not root:

su - cpaneluser
echo "smart host test $(date)" | mail -s "smarthost test" you@external.example.com
exit
exim -bp

exim -bp should be empty within a second or two. If the message stayed in the queue, run it with debug enabled and watch what happens:

exim -d+all -M $(exim -bp | awk '{print $3; exit}')

The router section should show send_via_smarthost: domains matching, and the SMTP conversation should show EHLO, STARTTLS, then AUTH LOGIN — if it skips AUTH the provider will reject with 530 Authentication required.

The provider-side check is fastest: SES, SendGrid, and Mailgun all show the message in their dashboard within seconds of accepting it, with the cPanel server IP under "via".

Per-domain overrides

A reseller running customer domains often wants their own marketing domains on SES while leaving customer mail going out direct (because the customer's DKIM is signed on the local keypair and the smart host would break alignment).

Replace the router with two routers, ordered:

smarthost_my_domains:
  driver = manualroute
  domains = lsearch;/etc/exim/smarthost_domains
  transport = smarthost_smtp
  route_list = * email-smtp.eu-west-1.amazonaws.com::587
  no_more

send_via_smarthost:
  # leave disabled or remove entirely

Populate /etc/exim/smarthost_domains with one domain per line. Only those domains route through SES; everything else uses the normal cPanel outbound path. The DKIM keypair the provider expects must be the one in the provider's dashboard, not the cPanel-generated one in /var/cpanel/domain_keys.

What to check after a week

Three things, in order:

1. Bounce rate at the provider. SES will throttle and then suspend the sending identity above 5%. Pull the suppression list weekly and feed addresses back to the cPanel accounts that generated them.
2. /var/log/exim_mainlog for R=send_via_smarthost. Every outbound delivery should show that router. If you see R=lookuphost or R=dnslookup for non-local domains, the smart host router didn't match — usually a typo in domains =.
3. Queue depth. exim -bpc should sit near zero. A growing queue with frozen messages means the provider is rejecting auth or your sending identity isn't verified.

For abuse follow-up, the Exim outbound throttling guide covers the per-account caps and outbound SpamAssassin scan that keep one compromised account from getting your provider account suspended.

Next steps

• Pair this with Exim outbound throttling on cPanel so a compromised account can't get your SES identity suspended.
• Make sure SPF, DKIM, and DMARC line up: cPanel deliverability checklist.
• Buying or renewing the underlying licence: cPanel licences.