Need a recommendation for an incoming email spam, malware, virus filter.

alento

A client of mine runs his own mail server with Mail-in-a-Box. He is wanting incoming mail filtering to deal with spam, and malware, etc. Mail-in-a-Box has Spamassassin, but that does nothing for anti-virus/malware protection. Does anyone have a good recommendation that I can pass along?

tgl

if you want to do it for free, you can try to use an UTM in a small VPS or well in another virtual machine to filter the incoming e-mail, Endian OS Community Edition would work like that, you can scan the e-mail using clamav and also set up other stuff, they have an SMTP proxy where you can configure some things like whitelists, attachments, etc

Mr_Tom

I run mailcow which runs clamav, but I've been looking into Proxmox Mail Gateway for another project. Not got round to looking into it, but it does spam/virus scanning/etc before passing emails on the mail server.

mfs

Since mail-in-a-box is using postfix, I'd recommend to make extensive use of postscreen filters. A properly tuned postscreen_dnsbl_sites and postscreen_dnsbl_threshold (along with other commonly used smtpd restrictions) will do wonders, relegating rspamd or amavisd-new (spamassassin+clamav) to a marginal role. Clamav's role seems even more marginal, unless you've really finely tuned it and improved detection with unofficial sigs. Its impact seems still negligible to me, but I don't focus on e-mails usually.
Mail-in-a-box should come with postgrey which helps already a little bit.

You could consider amavisd-new in your postscreen setup in order to deal with both spamassassin and clamav. Problem is, mail-in-a-box seems rather monolithic (I haven't used it); in their forum I see quite a few people tried to setup clamav using various approaches, sometimes without any issues and sometimes facing a borked install a few upgrades later. Also, there are an open (since 2016) and a "wontfix"-alike issues about clamav in mail-in-a-box's github.

Setting up an SMTP Proxy on a firewall distro is something I wouldn't offer for free, assuming the client is mostly running unmanaged self-hosted apps and is wandering for free hints. Hints may be free, services generally are not. Scanning their email is well-worth an extra $7

alento

Hi @tgl @Mr_Tom and @mfs

Thank you each for your comments - they are appreciated.

However, I was meaning more of a subscription product such as SpamTitan or similar. The client is not in a position to self host their own solution, so they are looking for a commercial one. I was hoping that there might be some folks here with familiarity with this kind of product.

@mfs as I am quite active on the MiaB support forum I am familiar with what you have said. I am not in a position at this time to create and host something of this nature, but it certainly is a great idea of something for me to develop in the future. Thanks again for your input.

ITLabs

@alento check MailChannels Inbound Filtering.

https://www.mailchannels.com/inbound/

Mr_Tom

If you were looking at subscription services, I can't remember exactly but pretty sure we had inbound spam/virus filtering from solarwinds msp at a previous place I worked.