SpamAssassin works, but it's not as good as some other solutions.
One step to take is to enable RBL's:
- Log into WHM for your server, and use the find field to search for ‘exim‘
- One of the links that this will display is ‘Exim Configuration Manager‘
- Go ahead and click on this link
- Use the additional search field and type in "RBL"
- Turn on both ‘RBL: bl.spamcop.net‘ and ‘RBL: zen.spamhaus.org’
- Click save at the bottom of the page
Another step is to enable sender verification:
While still on the Exim Configuration Manager page
- Click the Mail tab
- Turn on Sender Verification Callouts and then click save at the bottom of the page
You could also turn on DKIM. This is under the ACL section in the 'Exim Configuration Manager". It's in "Authentication" of cPanel.
Unfortunately, the best way is SpamExperts.