enforce_mail_permissions in cPanel/Exim

The enforce_mail_permissions setting in Exim — the mail server used by cPanel-based hosting — is a security feature that makes Exim refuse to deliver mail into directories whose ownership or permissions don't match the expected user. It prevents a malicious or misconfigured local account from writing into someone else's mailbox and stops a number of mail-spoofing scenarios on shared servers.

Below is a short reference for system administrators: how to check the current state of the option, how to turn it on or off via WHM or SSH, and how to handle the two error patterns you'll most often see right after enabling it.

This guide assumes root access to a cPanel/WHM server. On managed plans where you don't have WHM root, ask your provider's technical support to flip the option instead of editing /etc/exim.conf by hand.

What enforce_mail_permissions does

• Ensures every mail file is owned by the expected mailbox user.
• Blocks mail delivery if the target directory has overly permissive bits.
• Prevents a number of mail-spoofing patterns on shared hosts where one cPanel account could otherwise touch another account's mail tree.
• Surfaces broken permissions early instead of letting Exim silently deliver into a directory that other users can read.

Checking the current setting

Print the effective value Exim is running with:

exim -bP | grep enforce_mail_permissions

Expected output on a hardened cPanel box:

enforce_mail_permissions = true

If you see false, the protection is currently off — usually because someone disabled it during troubleshooting and never turned it back on.

Enabling enforce_mail_permissions

Via WHM (Exim Configuration Manager)

• Log in to WHM as root.
• Open Service Configuration → Exim Configuration Manager → Advanced Editor.
• Find the enforce_mail_permissions directive and set it to true.
• Click Save. WHM will restart Exim automatically.

Via SSH

• Open the Exim config:

  nano /etc/exim.conf

• Add or change the line:

  enforce_mail_permissions = true

• Save the file (Ctrl + X, then Y).
• Restart Exim:

  systemctl restart exim

• Verify the new value:

  exim -bP | grep enforce_mail_permissions

Disabling enforce_mail_permissions

• Edit Exim's config:

  nano /etc/exim.conf

• Change the value:

  enforce_mail_permissions = false

• Restart Exim and reproduce the issue you're debugging:

  systemctl restart exim

• Once the diagnosis is done, set the value back to true and restart Exim again.

Troubleshooting common issues

550-5.7.1 Your mail directory has incorrect ownership or permissions

chown -R user:mail /home/user/mail
chmod -R 700 /home/user/mail

exim -qff

If the failure is not at the Exim layer at all but inside PHP — for example, a script can't send mail through mail() — the cause is usually unrelated to enforce_mail_permissions. See Fix: mail() Has Been Disabled for Security Reasons in PHP for the disabled-functions angle.

cPanel Hosting

Full control over your website

• Convenient
• Simple
• Fast
• Free 7-day trial

View pricing

When to keep it enabled

• Shared hosting: keep it on. The risks it mitigates are exactly the ones shared hosts care about.
• Compliance: if you're audited for tenant isolation, this is one of the boxes auditors look for.
• Single-tenant servers: still leave it on. The performance cost is negligible and it surfaces permission drift you'd otherwise miss.
• Turning it off: reserve for short troubleshooting windows, never as a permanent fix.

For broader cPanel administration tasks unrelated to Exim, our cPanel hosting login and website setup guide walks through the typical day-one tasks on a new cPanel account.