While the Spam Assassin service is a great tool at fighting against incoming SPAM messages, unwanted emails continue to change in order to try and bypass these checks. To help the protection for this service keep up with your needs, the sa-learn utility(/usr/local/cpanel/3rdparty/bin/sa-learn) is included with the software installation by default. This tool can be used by the account owner to teach the Spam Assassin database what messages you deem as spam or ham(legitimate mail) directly, in order to update its detection database to meet your personal needs.
In order to use the sa-learn tool, the Spam Assassin service will need to be enabled and running for the related account. That account will also need to be configured to use the Maildir message storage so that individual message files can be passed to the command. It is also advisable that auto-delete be disabled for Spam Assassin so that any false positives can be marked as Ham.
With the above criteria met, the account user can then use the sa-learn command to mark specific emails as SPAM or HAM. Please note that this should not be run by the root user! The recommended method is to create a specific directory for each mail user to store the messages that should be processed and create a cron for the associated cPanel account to perform this task automatically. Alternatively, you can log in to SSH as the cPanel user and perform this task manually.
For detailed steps on configuring and using the sa-learn utility, please see the following link: