Imunify Email is the TuxCare anti-spam and anti-phishing engine that hooks directly into Exim on cPanel. It replaces the SpamAssassin + ClamAV combination most shared hosts limp along with, and adds an outbound classifier that stops compromised accounts from emptying your IP reputation into the nearest blocklist.

It is not part of Imunify360. Despite the shared brand, Imunify360 licenses do not include email filtering, and the AV+ scanner SKU we covered in the Imunify AV / AV+ / 360 breakdown is also email-blind. Imunify Email ships as its own SKU and its own agent. This guide walks the cPanel install end-to-end — about 25 minutes including warm-up time before scores stabilise.

Before you start

A cPanel & WHM server with Exim as the MTA (the default — Imunify Email does not currently hook Postfix on cPanel).
Root SSH, with outbound HTTPS to *.imunify.com and repo.imunify360.cloudlinux.com.
512 MB RAM headroom beyond your existing footprint. The classifier daemon and the per-message Python helpers together resident around 250-400 MB at 1k msg/hour.
An Imunify Email activation key. SKUs come in Inbound-only and Inbound + Outbound flavours — outbound is what you want on a shared box. Grab a key from our Imunify Email page or talk to sales for volume tiers.
AlmaLinux 8/9, Rocky 8/9, CloudLinux 7/8/9, or Ubuntu 20.04/22.04. CentOS 7 is end-of-life and unsupported — see the AlmaLinux migration guide if you are still on it.

Step 1 — Install the agent

Imunify Email installs from the same Defence360 repository as Imunify360, but the package and the deploy script are different. Do not reuse i360deploy.sh:

curl -o ime-deploy.sh https://repo.imunify360.cloudlinux.com/defence360/ime-deploy.sh
bash ime-deploy.sh --key YOUR-ACTIVATION-KEY

The script:

Adds the imunify-email yum/apt repository.
Installs the imunify-email package (the daemon, CLI, and Exim ACL hooks).
Registers the licence against the server's primary IP.
Writes the Exim configuration template to /etc/cpanel/ea4/exim/imunify-email.dist.
Rebuilds Exim via /scripts/buildeximconf so the hooks load on the next restart.

Total runtime on a fresh node is 4-6 minutes. The script is idempotent — re-run it after fixing any failure, do not unpick packages by hand.

Step 2 — Verify registration

Three things should be true before you let the classifier touch real mail:

# 1. Daemon is up
systemctl status imunify-email

# 2. Licence reports as valid
imunify-email license show

# 3. Exim is loading the ACL hooks
exim -bP | grep imunify

A healthy license show ends with status: ACTIVE and lists the SKU (inbound or inbound+outbound). If it says status: TRIAL and you bought a paid key, the IP bind did not take — usually because the deploy script ran behind a NAT gateway. Open a support ticket with both the server's outbound IP and what curl ifconfig.me returns, and we will rebind from the partner side.

Step 3 — Start in passive mode

The agent ships in --mode passive by default. Leave it there for the first 24 hours on a busy server. In passive mode the classifier scores every message and adds X-Imunify-Spam headers, but Exim still delivers based on SpamAssassin (or your existing rules). You get a free dry-run of the false-positive surface before any user-visible blocking happens.

Tail the decision log to watch it warm up:

tail -f /var/log/imunify-email/decisions.log

You want to see the HAM/SPAM ratio settle within an order of magnitude of your existing SpamAssassin stats. If Imunify is classifying 80% of legitimate marketing newsletters as SPAM and SpamAssassin was at 5%, you have a tuning problem (Step 5) — do not flip to active yet.

Step 4 — Flip to active mode and retire SpamAssassin

Once the 24-hour passive window looks sane:

imunify-email config update --mode active
systemctl restart exim

active mode lets Imunify Email act on its verdicts:

Inbound spam → routed to the per-user Imunify Email Quarantine folder (visible in cPanel under Email → Imunify Email).
Outbound spam → message is rejected at SMTP with 550 5.7.1 Blocked by Imunify Email, the sending cPanel account is rate-limited, and after the third hit in an hour the account is auto-suspended for outbound mail until you review it.
Phishing → blocked outright, both directions, no quarantine. Phishing is treated as unambiguously bad by the classifier.

Now disable SpamAssassin in WHM → Service Manager. Uncheck both spamd columns (monitor and enable) and Save. Confirm:

systemctl status spamassassin   # should be disabled
imunify-email stats             # should be the only scorer

Step 5 — Tune the false-positive surface

Two knobs cover 90% of complaints in the first week:

Sender allowlist per account. End users can add allowlist entries from the cPanel plugin (Email → Imunify Email → Allowlist). For server-wide allowlists (your billing provider, your monitoring vendor):

imunify-email allowlist add --sender "noreply@stripe.com"
imunify-email allowlist add --domain "uptimerobot.com"

Score threshold for the SPAM action. Default is 5.0. On a server that mostly hosts small business mail, 6.5 cuts false positives in half and still catches the obvious attacks. Marketing-heavy hosts (newsletters, mailing lists) often run at 7.0:

imunify-email config update --inbound-spam-threshold 6.5
systemctl restart imunify-email

The outbound threshold is separate and lives at --outbound-spam-threshold. Do not raise the outbound threshold above the default 5.0 — outbound false positives cost a customer one delayed email; outbound false negatives cost you an IP reputation incident and a week of clearing blocklists. Keep DKIM/SPF/DMARC properly set up too — see the cPanel deliverability guide.

Step 6 — Wire the quarantine into customer cPanels

The cPanel plugin is installed automatically but not enabled in the default Feature List. Add it for users:

WHM → Feature Manager → edit your default feature list.
Tick Imunify Email Quarantine under the Email section.
Save.

Without this, customers cannot self-release a false positive and will email you instead. On a 500-account shared box that is the difference between a quiet inbox and ten tickets a day in the first week after going active.

How Imunify Email interacts with Imunify360 and JetBackup

A few integration notes that surprise people:

Imunify360 dashboard absorbs the Email tile if both products are licensed against the same key bundle. You get one WHM plugin instead of two, with the Email stats under Imunify360 → Email.
Outbound rate-limiting overlaps with Exim throttling. If you already followed the outbound throttling guide, Imunify Email's auto-suspend will trigger before your MAX_MSGS_HOUR_HOST limit. That is the intended precedence — Imunify is content-aware, the cPanel limit is volume-blind.
JetBackup excludes the quarantine directories automatically from backups (/var/cpanel/imunify-email/quarantine/*). Custom backup scripts will not.

Common install snags

The deploy script reports EXIM_REBUILD_FAILED. Usually a stray hand-edited Exim configuration that fails /scripts/buildeximconf. Run that script manually, fix the syntax error it surfaces, then re-run ime-deploy.sh.

X-Imunify-Spam headers are missing on inbound mail in passive mode. Confirm the ACL is attached: exim -bP | grep acl_smtp_data should reference imunify_email_inbound. If it does not, the EA4 Exim build step did not pick up the template — re-run /scripts/buildeximconf and restart Exim.

For licensing across the broader Imunify family — whether to buy Imunify Email alone, bundle with Imunify360, or step up to AV+ — see the Imunify SKU breakdown and the pricing page for current tier costs.

Is Imunify Email included with Imunify360?+

No. Imunify360 and Imunify Email are separate SKUs from the same vendor. An Imunify360 licence covers the WAF, malware scanner, brute-force protection, and Proactive Defense — but not email filtering. You buy Imunify Email separately, per server.

Does Imunify Email replace SpamAssassin on cPanel?+

Yes. Once Imunify Email is in active mode, disable SpamAssassin in WHM → Service Manager. Running both wastes CPU on duplicate scoring and produces conflicting X-Spam headers. Disable SpamAssassin after Imunify Email is live, not before, so you always have a working scorer.

Will Imunify Email work without Imunify360 installed?+

Yes. Imunify Email is a standalone product. It runs on cPanel, Plesk, and DirectAdmin servers with or without the security suite. If both are installed and licensed under the same key bundle, the WHM dashboards merge into one.

How is outbound spam protection different from Exim rate limits?+

Exim rate limits cap message volume but cannot tell a newsletter from a phishing run. Imunify Email scores message content and reputation, suspends the sending cPanel account after repeated SPAM verdicts, and lets legitimate high-volume users keep sending. The two stack — Imunify catches content abuse, Exim catches sheer volume floods.

Does Imunify Email support Postfix or only Exim?+

On cPanel only Exim is supported, because cPanel ships Exim as the MTA. The Plesk build of Imunify Email supports Postfix natively. There is no current build for the DirectAdmin Postfix configuration.

Can I move my Imunify Email licence to a new server IP?+

Yes. Open a ticket with the seller (us, if you bought it from us) with the old IP and the new IP — the rebind is partner-side and immediate, you do not need a new key. The agent re-registers on the next licence check after the bind moves.

Next steps

Pair Imunify Email with a properly tuned SPF/DKIM/DMARC stack — anti-spam scoring is only half the deliverability story.
For broader outbound abuse defence, the Exim outbound throttling playbook covers the volume side that Imunify Email's content scoring complements.
If you have not already deployed Imunify360, the two products share one dashboard once both licences are active — install order does not matter.

Install Imunify Email on cPanel for inbound and outbound spam filtering