Email filters act on messages as they arrive: sorting them into folders, forwarding them, or discarding them. They run on the server, so they work regardless of which device you read mail on: unlike rules configured in a desktop client, which only run while that client is open.
That distinction is the reason to set filters here rather than in Outlook.
Account filters or user filters
cPanel offers two, and picking the wrong one is the most common confusion.
Global Email Filters apply to every mailbox on the account. Use them for domain-wide policy.
Email Filters apply to one mailbox. Use them for how one person wants their mail sorted.
A global filter that discards messages affects everyone, including addresses you forgot existed. Start with the per-mailbox version unless the rule genuinely belongs to the whole domain.
How a filter is built
Each filter has a name, one or more conditions, and one or more actions.
Conditions test a part of the message, From, To, Subject, Body, or any header, against a comparison such as contains, matches, or begins with.
Multiple conditions can be combined with and or or. Getting that wrong is the usual reason a filter catches too much or nothing at all: "Subject contains invoice and From contains supplier" is far narrower than the same two joined with or.
The actions worth knowing
Deliver to folder. The safe default for organising mail. Nothing is lost; it is just somewhere else.
Discard. Deletes silently, with no notice to the sender. Dangerous, and covered below.
Redirect to email. Sends it elsewhere instead.
Fail with message. Rejects it and tells the sender why.
Stop processing rules. Ends filtering for that message, which matters when several filters could match.
Order matters, and it is not obvious
Filters run top to bottom, and a message can be touched by several.
Put narrow rules above broad ones. A filter sending everything from a domain to one folder, placed above a filter that would have sorted certain subjects from that domain elsewhere, means the second never runs.
Use "stop processing rules" deliberately when a match should be final. Without it, a message filed correctly by one rule can be moved again by a later one.
Discard is the rule to be careful with
A discarded message is gone. The sender is not told, and there is nothing to recover.
The failure mode is a filter that is slightly too broad: a rule discarding anything with "invoice" in the subject also discards a genuine invoice from a supplier.
Send to a folder instead, at least at first. Check that folder for a fortnight, confirm nothing legitimate is landing there, and only then switch to discard if you want to.
For mail you are certain is unwanted, discard is also kinder to your quota than a folder that fills up. Managing mailbox quotas deals with that side.
Test before relying on it
cPanel has a filter test: paste a message and it tells you which filters would match.
Use it. A filter that looks right and matches nothing is common, usually because the condition tests the wrong header, Subject rather than From, or the display name instead of the address.
Test with a real message instead of a made-up one. Real mail contains headers, encodings and formatting that a typed example does not.
Filtering on the sender is weaker than it looks
The From address is trivially forged. A filter allowing mail from a particular sender is not a security control, and one blocking a spammer's address stops working the moment they change it.
For unwanted mail, filtering on content patterns is more durable than filtering on addresses. For genuinely important senders, authentication matters more than any filter. Understanding SPF, DKIM and DMARC sets out what actually verifies a sender.
Filters and forwarders together
A forwarder sends everything for an address elsewhere. A filter can forward selectively, which is more useful.
One caution that applies to both: forwarding to an external provider can damage your domain's sending reputation, because you are relaying mail that failed the original sender's checks. If a lot of forwarded mail is spam, the receiving provider attributes it to your server.
Prefer collecting mail from the mailbox over forwarding it when the volume is significant. Setting up forwarders goes into the trade.
Catch-all addresses
A catch-all receives everything sent to any address at the domain, including the thousands of guessed addresses that spam senders try.
It fills quickly, and it is why a mailbox nobody uses can be the largest thing on the account. Filters can tame it, and the better answer is usually to turn the catch-all off and create the addresses you actually need.
Filters do not replace spam filtering
The spam filter runs before your rules and scores messages. Your filters can act on that score, sending anything above a threshold to a folder, which is a far better rule than trying to identify spam yourself by keyword.
Writing keyword rules to catch spam is a losing game: the senders change wording constantly, and your rules accumulate into something nobody can reason about. For setting the score threshold properly, see configuring spam filters.
Test a filter before relying on it
Send yourself a message that should match and confirm it lands where the rule says. A filter that matches nothing looks identical to one that is working, since both leave the inbox unchanged. The rules that need this most are the ones that move mail out of sight, because a rule filing messages into a folder nobody opens is indistinguishable from mail that never arrived. Check the order too, since the first matching rule usually decides and later ones never run.