Virus scanning

On Business and Platform, attachments can be scanned for malware before delivery. Scanning is off by default: turn on Scan attachments for viruses under Settings → Storage. An infected file is never delivered and never stored; your webhook sees only that it was there.

Powered by ClamAV

EmailConnect uses ClamAV, the open-source antivirus engine maintained by Cisco's Talos Intelligence Group.

  • Open source — fully auditable, no black-box scanning
  • Broad coverage — detects viruses, trojans, ransomware, phishing payloads and other threats

Virus definition updates

Virus definitions are updated automatically via ClamAV's built-in freshclam daemon. Definitions are stored persistently, so restarts don't trigger a full re-download.

Updates are applied in the background without service interruption. To keep memory usage predictable during updates, new definitions are loaded sequentially rather than in parallel with the old set.

How scanning works

  1. An email with attachments arrives at your alias
  2. Each attachment is streamed to the ClamAV daemon for scanning. Images, audio, video and plain text are skipped
  3. Clean files are delivered normally with scan metadata in the payload
  4. Infected files are excluded: the entry stays in the payload, without content or download URL, and the file is not stored anywhere

Scanning happens inline before your webhook fires. There is no separate queue or delay beyond the scan itself.

Clean file payload

Clean attachments include a virusScan object confirming the result:

{
  "filename": "report.pdf",
  "contentType": "application/pdf",
  "size": 48210,
  "downloadUrl": "https://app.emailconnect.eu/attachments/.../download",
  "virusScan": {
    "status": "clean"
  }
}

Infected file payload

An infected attachment stays in the payload as an excluded entry, so you know it was there. It has no content and no download URL, and the file is not stored anywhere: not in storage, not inline, not in our database.

{
  "filename": "eicar_com.zip",
  "contentType": "application/x-zip-compressed",
  "size": 184,
  "excluded": true,
  "excludeReason": "virus-detected",
  "status": "rejected",
  "virusScan": {
    "status": "infected",
    "threat": "Eicar-Test-Signature"
  }
}

When scanning is on and the email has attachments, a top-level security.virusScan summary gives the scan statistics. If the scanner is unavailable, nothing is flagged: the email is delivered with scanned: false and reason: "scanner-unavailable", so your handler should treat those attachments as unscanned. See the webhook payload reference for full field documentation.

Testing virus scanning

Send an email with the EICAR test file attached. This is a harmless industry-standard test string that every antivirus engine detects. Your webhook payload will show the attachment as rejected with threat Eicar-Test-Signature.

Limits

Attachments up to 10 MB are scanned. This matches the maximum email size accepted by EmailConnect.

Availability

Virus scanning is available on Business and Platform plans. On lower plans, attachments are delivered without scanning.

Related topics