mailips & mailhelo in Exim cPanel — Complete Guide 2026

So here’s the deal — you’ve configured SPF, DKIM, DMARC, and everything looks perfect on paper. But your emails still land in the spam folder. Or worse, they get rejected outright. I’ve been there. It was 3 AM, a client’s transactional emails (password resets, order confirmations) just stopped working. Their support inbox was flooded with angry customers. Panic mode, right?

After digging through Exim logs for hours, I found the culprit: mailhelo = vmi54321.contabo.net. The server was using the default provider hostname. And because that hostname didn’t match the sending domain or the PTR record, Gmail and Outlook were rejecting HELO before even checking SPF or DKIM. That night, I learned a hard lesson about mailips and mailhelo.

Let me walk you through everything I wish I knew back then. What mailips and mailhelo actually do, why they matter more than most sysadmins realize, and exactly how to configure them for maximum deliverability. No fluff, just practical commands and real-world configs.

What Are mailips and mailhelo? Breaking Down the Basics

Let’s start with the fundamentals. These two directives live in /etc/exim.conf and control how Exim presents itself when sending emails. They’re simple config lines with massive implications.

mailhelo — Your Exim Identity at the SMTP Level

Think of mailhelo as your server’s name tag when it walks into a room. Every time Exim connects to a remote SMTP server, the first thing it says is “HELO [hostname].” That hostname comes directly from the mailhelo config.

Here’s an analogy: imagine you’re sending a letter at the post office. You tell the clerk, “Hi, I’m John from 123 Main Street.” If you give a fake address or an address that can’t be found, the clerk gets suspicious. Email servers do the same thing — they verify the HELO hostname against DNS and PTR records. If something doesn’t add up, your email gets flagged or rejected.

A typical mailhelo config looks like this:

mailhelo = mail.yourdomain.com

mailips — Outbound IP Access Control

mailips defines which IP addresses Exim is allowed to use when sending emails. It’s essentially an allowlist for outbound SMTP connections. This becomes critical when your server has multiple IPs and you need precise control over email reputation.

Example:

mailips = 203.0.113.10 : 203.0.113.11 : 203.0.113.12

If one of your IPs gets blacklisted (say 203.0.113.12 got flagged because a client’s script was sending spam), you simply remove it from mailips. Exim will never use that IP for outbound email again.

Why This Configuration Actually Matters for Deliverability

Here’s what most people get wrong: they jump straight to SPF and DKIM without fixing the foundation. But before Gmail or Outlook check your SPF record, they check your HELO hostname. It’s the first impression your server makes.

How mailhelo Affects Your Email Score

Modern email servers (Gmail, Outlook, Yahoo, ProtonMail) run multiple checks on your HELO:

• Hostname validity — Does the hostname resolve via DNS?
• PTR match — Does the sending IP have a PTR record pointing to this hostname?
• Consistency — Does the HELO hostname align with the domain in MAIL FROM?

Each failed check adds spam points. Severe failures (like non-resolvable hostnames) can trigger immediate rejection with 550 or 554 SMTP codes.

How mailips Affects Sender Reputation

Imagine you have a server with 5 IPs. One of them got blacklisted because a compromised WordPress plugin was sending spam. Without a properly configured mailips, Exim might randomly pick that blacklisted IP for outgoing mail. Result? All your emails get blocked, even the legit ones from clean domains.

With mailips, you maintain strict control. And here’s a pro move: match your mailips entries exactly with your SPF records. If SPF says only 2 IPs are authorized, set those same 2 IPs in mailips.

Checking Your Current mailips and mailhelo Configuration

Let’s see what your server is currently using. You might be surprised.

Via Command Line (SSH)

exim -bP mailhelo
exim -bP mailips

Expected output:

mailhelo = server.hostingprovider.com
mailips = 203.0.113.10 : 203.0.113.11

If mailips returns empty, Exim will use the default IP from the primary network interface. This isn’t necessarily broken, but it’s not optimal for multi-IP servers.

Via WHM

1. Log into WHM as root
2. Navigate to Home > Service Configuration > Exim Configuration Manager
3. Click the Basic Editor tab
4. Scroll down to find “mailhelo” and “mailips” fields

In WHM, these fields are near the bottom of Basic Editor. mailhelo usually auto-populates with the server hostname. That’s exactly what we need to change.

Step-by-Step: How to Configure mailhelo Properly

Alright, let’s get our hands dirty. Here’s the exact process I use on every server I manage.

Step 1: Choose the Right Hostname

Never use your provider’s default hostname. Create a dedicated email hostname. Example: mail.yourdomain.com

Step 2: Set Up Correct DNS Records

For mail.yourdomain.com, ensure:

• A record: mail.yourdomain.com -> 203.0.113.10
• PTR record: 203.0.113.10 -> mail.yourdomain.com (configured via your hosting provider or DNS panel)

The PTR record is non-negotiable. Gmail and Outlook check this aggressively. No PTR = spam folder.

Step 3: Update Exim Configuration

Via WHM: Change the mailhelo field from the default hostname to mail.yourdomain.com. Save.

Via CLI:

echo “mailhelo = mail.yourdomain.com” >> /etc/exim.conf

Remove any existing mailhelo line if present (usually near the top of /etc/exim.conf).

Step 4: Restart Exim

systemctl restart exim

Step 5: Verify

exim -bP mailhelo

Should show mail.yourdomain.com.

Step-by-Step: Optimal mailips Configuration

Now let’s lock down your outbound IPs.

Step 1: Identify Available IPs

ip addr show | grep inet

Select 1-3 IPs with clean reputations. Check each IP at MXToolbox Blacklist Check before using them.

Step 2: Update mailips

Via WHM: Fill in the mailips field with your chosen IPs separated by colons:

203.0.113.10 : 203.0.113.11

Via CLI:

echo “mailips = 203.0.113.10 : 203.0.113.11” >> /etc/exim.conf

Step 3: Update SPF Records

This is where most people slip up. After changing mailips, update your SPF records! Every domain that sends email from this server needs its SPF updated. Example:

v=spf1 ip4:203.0.113.10 ip4:203.0.113.11 include:_spf.google.com ~all

Step 4: Restart and Verify

systemctl restart exim
exim -bP mailips

How mailips and mailhelo Fit Into the Authentication Chain

Here’s something many guides don’t tell you: mailips and mailhelo aren’t isolated settings. They’re part of an authentication chain that starts with HELO and ends with DMARC.

Component	Function	Relationship with mailips/mailhelo
PTR Record	Maps IP to a hostname (reverse DNS)	Must match mailhelo. Gmail checks this on every connection.
SPF	Lists authorized sending IPs	Must include all IPs from mailips. Mismatch = SPF fail.
DKIM	Digital signature for email integrity	Domain in DKIM signature must be legitimate. Not directly tied to mailhelo but consistency matters.
DMARC	Policy for SPF/DKIM failures	A bad mailhelo can cause SPF to fail, and DMARC decides your email’s fate.

The authentication chain looks like this: HELO check -> PTR check -> SPF check -> DKIM check -> DMARC policy. If the HELO check fails, the chain breaks before it even begins.

Troubleshooting: Why Email Deliverability Still Sucks

Symptom	Likely Cause	Solution
550 “Helo command rejected”	mailhelo doesn’t resolve in DNS	Set mailhelo to a hostname with a valid A record
Emails land in Gmail spam	PTR doesn’t match mailhelo	Align PTR record with mailhelo hostname
554 5.7.1 rejection	IP blacklisted or poor reputation	Check IP in MXToolbox, replace in mailips
Emails sent but silently bounced	SPF fail (IP not in SPF record)	Update SPF to include all IPs from mailips
Exim sends from wrong IP	mailips empty or misconfigured	Explicitly set mailips with correct IPs

Pro Tips From a NOC Engineer Who Learned the Hard Way

Here’s advice you won’t find in the Exim documentation. Stuff I learned from fixing broken email servers at 2 AM.

1. Use a Dedicated Email Hostname
Never — and I mean never — use the default provider hostname (like server01.provider.com) as mailhelo. Create a clean hostname like mail.yourdomain.com. It signals legitimacy to spam filters. It takes 5 minutes and pays off massively.

2. Dedicated IPs for Email Only
Separate your email traffic onto dedicated IPs. If you share IPs with websites, you’re asking for trouble. A single compromised WordPress site can get the IP blacklisted, taking down email for every domain on that server.

3. Maintain 2-3 IPs for Rotation
Have 2-3 email IPs in your mailips list. If one gets blacklisted, you have fallback options. Don’t go overboard though — more than 5 IPs becomes hard to manage.

4. Check Logs Daily
Make it a habit to check Exim logs every morning:

tail -50 /var/log/exim_mainlog | grep -E “(550|554|rejected)”

Early detection saves you from reputation disasters.

5. Verify PTR Before Changing mailhelo
Test your PTR record before setting mailhelo:

dig -x 203.0.113.10 +short

If the output doesn’t match your intended mailhelo, fix PTR first.

6. SPF Must Match mailips — Always
Every time you modify mailips, update SPF. I can’t stress this enough. I’ve seen servers where the admin changed IPs but forgot SPF. Result: SPF fail on every email, killing deliverability. Don’t be that person.

Real-World Case: What I Learned From a Client’s Meltdown

One of my clients ran an online store — let’s call the domain shopnow.com. Every week, they sent newsletters to 50,000 subscribers. Then one day, open rate dropped from 25% to 2%. Bounce rate skyrocketed. Revenue from email campaigns dried up overnight.

I checked their Exim config. mailhelo was set to vps12345.ovh.net. Their sending domain was shopnow.com. Gmail’s spam filter flagged every single email. After I changed mailhelo to mail.shopnow.com, fixed the PTR record, and aligned the SPF, their open rate recovered to 20% within 72 hours.

The lesson? A three-line config change saved a business. Never underestimate the importance of mailhelo.

Essential Commands to Keep Handy

Command	What It Does
exim -bP mailhelo	Check active mailhelo value
exim -bP mailips	Check active mailips value
exim -bt user@domain.com	Test email routing
systemctl restart exim	Restart Exim after config changes
tail -100 /var/log/exim_mainlog	View latest Exim log entries
dig -x [IP] +short	Lookup PTR record for an IP
curl -s https://mxtoolbox.com/api/v1/lookup/blacklist.aspx?ip=[IP]	Check IP blacklist status via API

FAQ — Questions I Get Asked All the Time

Related Articles

• Complete Guide to SPF, DKIM, and DMARC Configuration in cPanel
• 5 Ways to Troubleshoot Emails Going to Spam in cPanel — 2026
• How to Check and Clean Server IP Blacklist — Step by Step
• Exim cPanel Optimization: Config Tuning to Prevent Mail Queues
• How to Set Up Reverse DNS (PTR Record) for Your VPS

Conclusion

Here’s the bottom line: mailips and mailhelo are the foundation of your email server’s reputation. Get this right and everything else (SPF, DKIM, DMARC) has a solid base to work from. Get it wrong and you’re building your email infrastructure on sand.

Quick recap of what to do:

1. Set mailhelo to an email-specific hostname (not your server hostname)
2. Ensure the PTR record matches your mailhelo exactly
3. Configure mailips with dedicated email IPs
4. Align your SPF records with the IPs in mailips
5. Restart Exim and verify
6. Test deliverability with mail-tester.com or Port25

I’ve configured hundreds of servers this way, and the results are consistent: better deliverability, fewer rejections, and happier clients. Give it a try on a staging box first if you’re nervous. But honestly, the commands are safe and the payoff is huge. Good luck!