Antivirus Configuration

Configure ClamAV integration for email malware scanning.

Prerequisites

ClamAV must be installed and running:

Linux

# Install ClamAV
sudo apt install clamav clamav-daemon

# Update virus definitions
sudo freshclam

# Start daemon
sudo systemctl start clamav-daemon

macOS

# Install via Homebrew
brew install clamav

# Update definitions
freshclam

# Start daemon
clamd

Docker

docker run -d -p 3310:3310 clamav/clamav:latest

Basic Configuration

antivirus:
  enabled: true
  host: localhost
  port: 3310
  on_virus_detected: quarantine

Options

Option	Type	Default	Description
`enabled`	boolean	`false`	Enable antivirus scanning
`host`	string	`localhost`	ClamAV daemon host
`port`	integer	`3310`	ClamAV daemon port
`timeout`	duration	`30s`	Scan timeout
`on_virus_detected`	string	`quarantine`	Action when virus detected

Virus Actions

Action	Description
`quarantine`	Move to quarantine folder
`delete`	Delete the email
`flag_only`	Flag email but don't move/delete

Quarantine Action

Emails with viruses are moved to a quarantine folder:

antivirus:
  enabled: true
  on_virus_detected: quarantine

Creates folder: Quarantine (if it doesn't exist)

Delete Action

Destructive: Emails with viruses are permanently deleted.

antivirus:
  enabled: true
  on_virus_detected: delete

Flag Only

Flag suspicious emails without moving:

antivirus:
  enabled: true
  on_virus_detected: flag_only

Emails are flagged with X-Mailpilot-Virus: detected

Troubleshooting

ClamAV Not Running

Error: Failed to connect to ClamAV

Solution:

# Check if ClamAV is running
sudo systemctl status clamav-daemon

# Or test connection
telnet localhost 3310

Outdated Virus Definitions

Update regularly:

sudo freshclam

Performance Issues

Scanning large attachments can be slow.