cPanel / WHM Smarthost Setup
You define three sections in WHM’s Exim Configuration Manager: routing, transport and authentication. After that, every message leaving the server is relayed through MXGate over an authenticated, encrypted connection. Your inbound settings and MX records are left untouched.
The only thing that changes is the path out
Today your cPanel server delivers email straight to the recipient’s server, and whether it arrives is decided by the reputation of your server’s IP address alone. After setup, the same message is handed to MXGate first, inspected there, and sent on from continuously monitored addresses.
cPanel smarthost setup in seven steps
The steps are applied in order in the WHM interface. You can copy the code blocks as they are; only the username and password placeholders in step five need to be replaced.
-
Open Exim Configuration Manager in WHM
Log in to WHM as the root user and type “Exim” in the search box at the top to open Exim Configuration Manager.
WHM PATH copyHome › Service Configuration › Exim Configuration Manager
-
Switch to the Advanced Editor tab and take a backup
The Advanced Editor tab lets you edit the sections of the Exim configuration directly. Before making any change, take a backup of the current configuration with the Backup button on the page.
Survives updates: anything you add in the Advanced Editor is stored in/etc/exim.conf.localand is preserved across cPanel updates. The main/etc/exim.conffile is regenerated on every build, so never edit it by hand. -
ROUTERCONFIG: add the routing rule
Add the router definition below to the ROUTERCONFIG section. It routes all mail that is not addressed to a local domain through MXGate.
ROUTERCONFIG copy# MXGate smarthost router smarthost_router: driver = manualroute domains = ! +local_domains transport = mxgate_smtp route_list = * smtp.mxgate.com.tr::587 no_more
Thedomains = ! +local_domainsline keeps mail between accounts on the server local instead of sending it out. Do not remove it. -
TRANSPORTCONFIG: add the transport definition
Add the transport definition, including the authentication and TLS requirements, to the TRANSPORTCONFIG section.
TRANSPORTCONFIG copy# MXGate SMTP transport mxgate_smtp: driver = smtp hosts = smtp.mxgate.com.tr port = 587 hosts_require_auth = smtp.mxgate.com.tr hosts_require_tls = smtp.mxgate.com.tr
Port 587 is used with STARTTLS, so credentials and message content travel encrypted. Thehosts_require_tlsline prevents falling back to an unencrypted connection. -
AUTH: enter the authentication credentials
Add the client authenticator containing the username and password from your MXGate panel to the AUTH section.
AUTH copy# MXGate SMTP authentication smarthost_login: driver = plaintext public_name = LOGIN client_send = : MXGATE_KULLANICI_ADI : MXGATE_SIFRE
Careful: theclient_sendline must start with a colon:: username : password. Replace the placeholders with the real credentials from your panel, and do not wrap the password in quotes. -
Save and restart Exim
Click the Save button at the bottom of the page. WHM validates the configuration, rebuilds it and restarts Exim. You can run the same checks over SSH if you prefer.
SSH · VERIFY copy# Any syntax errors in the configuration? exim -bV # Rebuild and restart the service if needed /scripts/buildeximconf /scripts/restartsrv_exim
-
Send a message and read the log
Send a message from an account on the server to an external address and confirm in the Exim log that it left through MXGate. If you see the router name in the log, the setup is working.
TEST · LOG copy# Watch the queue and the live log exim -bp tail -f /var/log/exim_mainlog # The line you should see in the log => kullanici@ornek.com R=smarthost_router T=mxgate_smtp
Setup complete. Once you see this line, all mail leaving the server is going through MXGate, authenticated and encrypted.
What does the error in your Exim log mean?
The five rows below cover almost every error seen after a cPanel smarthost setup. Look for the text from your log in the left column.
| Error in the log | What it means | Fix |
|---|---|---|
| 535 Authentication failed | The username or password was not accepted | Check that the client_send line in the AUTH section starts with a colon, and copy the credentials from the panel again. There must be no quotes or spaces in the password. |
| Connection refused / timed out | Outbound access to port 587 is blocked | Allow outbound port 587 in the server firewall and on your provider’s network. Some hosting networks close this port by default. |
| TLS required but not supported | An encrypted connection could not be established | Confirm that the hosts_require_tls line is present in the TRANSPORTCONFIG section and that the OpenSSL packages on the server are up to date. |
| Mail stays local | The router is not being read, or the order is wrong | Check that the smarthost_router definition was added to the ROUTERCONFIG section and that the indentation is two spaces. Exim silently skips a definition with bad indentation. |
| Mail between accounts also goes out | The domains condition is missing | Confirm that the domains = ! +local_domains line is present in the router. Without it, mail between accounts on the server is routed outside as well. |
Rolling back
If you want to undo the setup, remove the three sections you added in the Advanced Editor and save. Restoring the backup has the same effect: once the configuration is rebuilt, the server goes back to sending mail directly as before.
# Back up the local configuration, then edit it cp /etc/exim.conf.local /etc/exim.conf.local.mxgate-bak # Rebuild the configuration and restart the service /scripts/buildeximconf /scripts/restartsrv_exim
Questions from server administrators
Does this setup affect incoming email?
No. The configuration only changes the path that mail leaving the server takes. Your MX records, mailboxes and inbound settings stay exactly as they are. Putting inbound traffic through MXGate as well is a separate step, made through the MX record.
Will a cPanel update wipe these settings?
No. The sections you enter in the Advanced Editor are stored in /etc/exim.conf.local and are preserved across updates. The file that gets replaced is /etc/exim.conf, which is regenerated on every build, which is why the configuration should never be written there by hand.
Do we need separate credentials for each account on the server?
No. One set of credentials at server level is enough, and mail from every account leaves over the same connection. Reporting in the panel is still broken down by domain and sender, so you can still see which account sent what.
Is there a mail outage while saving?
There is a pause of a few seconds while Exim restarts. Incoming connections are retried during that window and queued messages are not lost. Even so, it is best to make the change outside peak sending hours.
Can we roll the setup back?
Yes. Remove the three sections you added in the Advanced Editor and save, or restore the backup you took before setup. Once the configuration is rebuilt, the server goes back to sending mail directly as before.