How to add a warning when an email is coming from an external domain

Question

How can I prepend [External] to the subject line of inbound emails that originate from outside the recipient's domain in cPanel & WHM?

Answer

This can be accomplished by adding a custom router to Exim via WHM's Exim Configuration Manager. The router checks the envelope sender domain against the recipient domain and modifies the subject line for any message that originates externally. This can help identify any spoofed email.

• Log in to WHM as root.
• Navigate to Home > Service Configuration > Exim Configuration Manager and click the Advanced Editor tab.
• Scroll to the PREFILTER section and add the following block:

CONFIG_TEXT: external_filter:
  driver = redirect
  allow_filter
  data = ${local_part}@${domain}
  condition = ${if !eq{$sender_address_domain}{$domain}{yes}{no}}
  headers_add = X-Original-Subject: $h_subject
  headers_remove = Subject
  headers_add = Subject: [External] $h_subject
  user = "${lookup{$domain}lsearch{/etc/userdomains}{$value}}"
  no_verify

• Click Save and restart Exim when prompted.

To verify, send a test message to an address on the server from an external account. The subject line should be prefixed with [External]. A message sent from an address on the same domain should arrive with no changes to the subject.

The original subject is preserved in the X-Original-Subject header.