ClamAV provides open-source antivirus scanning for incoming email — catching malware attachments before they reach recipients' inboxes, an important layer for a self-hosted mail server.
Why Virus Scanning Matters for Self-Hosted Mail
Hosted email providers typically include virus scanning as a standard feature — running your own mail server means you're responsible for this protection layer yourself; skipping it leaves your users exposed to malware-laden attachments.
Step 1 — Install ClamAV
sudo apt install clamav clamav-daemon -yStep 2 — Update Virus Definitions
sudo systemctl stop clamav-freshclam
sudo freshclam
sudo systemctl start clamav-freshclamStep 3 — Start the ClamAV Daemon
sudo systemctl enable --now clamav-daemonStep 4 — Install amavisd-new (Integration Layer)
sudo apt install amavisd-new -yamavisd-new coordinates between Postfix, ClamAV, and SpamAssassin, letting all three work together in a single integrated content-filtering pipeline.
Step 5 — Configure amavisd-new
sudo nano /etc/amavis/conf.d/15-content_filter_mode@bypass_virus_checks_maps = (0);
@bypass_spam_checks_maps = (0);Ensures both virus and spam checking are actively enabled, not bypassed.
Step 6 — Integrate with Postfix
sudo nano /etc/postfix/main.cfcontent_filter = amavis:[127.0.0.1]:10024sudo nano /etc/postfix/master.cfamavis unix - - y - 2 smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o disable_dns_lookups=yes
127.0.0.1:10025 inet n - y - - smtpd
-o content_filter=
-o local_recipient_maps=
-o smtpd_restriction_classes=Step 7 — Restart Services
sudo systemctl restart amavis postfixTesting Virus Scanning
curl -o eicar.txt https://secure.eicar.org/eicar.com.txtThe EICAR test file is a standard, harmless test string that all antivirus software should detect — send an email with this as an attachment to verify your scanning pipeline correctly catches and blocks it.
Configuring Actions for Detected Viruses
$final_virus_destiny = D_DISCARD;Configure amavisd-new's handling — discard, reject, or quarantine detected virus-containing messages, depending on your preferred policy.
Keeping Virus Definitions Current
freshclam runs as a service, automatically checking for and applying updated virus definitions — verify it's running continuously (systemctl status clamav-freshclam), since outdated definitions leave you exposed to newer threats.
Monitoring Scanning Activity
sudo tail -f /var/log/mail.log | grep -i virusCommon Errors
Legitimate mail rejected as containing a virus — false positives occasionally occur; verify with a manual scan if genuinely suspected, and report false positives to ClamAV's project if confirmed, helping improve future detection accuracy.
Continue Reading
- How to Configure SpamAssassin for Spam Filtering
- How to Install and Configure Postfix as a Mail Transfer Agent
- VPS Security Checklist for Beginners
Browse more articles in Email Hosting & Deliverability.
