Backup MX Email Bypasses Spam Filters

Symptoms

When using a Backup MX server, email bypasses any spam filters in place on the local cPanel & WHM server. 

Description 

By design, a Backup MX server is considered a trusted mail server. All mail from that host will be accepted and is exempt from SpamAssassin and other anti-spam checks done on the local cPanel & WHM server.

The cPanel & WHM server expects that the Backup MX server performed anti-spam checks already on the Backup MX server and that all mail arriving from a Backup MX is desirable mail.

Please see the following diagram for a high-level view of the expected implementation of a Backup MX server.

Workaround

Implement SpamAssassin and other anti-spam checks at the "Backup MX" server to scan all mail before being delivered to the cPanel & WHM server.