Skip to content

Add an SMTP malware scan policy (legacy mode)

You can specify filter criteria and actions for malware and attachments in senders' and recipients' emails. You can specify the file types to control, antivirus engines, quarantine action, and notification settings.

To add an SMTP malware scan policy, do as follows:

  1. Go to Email > Policies, click Add a policy and then click SMTP malware scan.
  2. Enter a name.
  3. Specify the email address or domain groups of senders and recipients.
  4. Specify the filters for attachments.

    Option Description
    Block file types Select the type of attachments to block. To select more than one file type, press Ctrl+Shift. The MIME list shows the MIME headers.
    MIME whitelist To allow certain file types, select their MIME headers. Antivirus scanning blocks the remaining file types.
  5. Select the scanning action.

    Option Description
    Disable Emails aren't scanned.
    Single antivirus Primary antivirus engine scans emails. The selection applies only to inbound emails. Sophos Firewall uses both antivirus engines to scan outbound emails.
    Dual antivirus Primary and secondary engines scan emails sequentially.
  6. Select the action for scanned emails.

    Option Description
    Quarantine Select to quarantine the email.
    Note: Quarantined emails are delivered based on the recipient action that you specify.
    Notify sender Select to withhold mail and notify the sender that an email is infected.
    Note: To notify the sender, you need to set the recipient action to Don't deliver.
    Delivery option for recipient Select the recipient action for infected and protected attachments. The action applies to suspicious attachments too.

    Don't deliver: Doesn't send the email and notification to the recipient.

    Deliver original: Sends the email to the recipient.

    Remove and deliver: Removes the infected attachment, sends a notification of removal, and delivers the email.
    Note: Doesn't apply to the blocked file types that you've specified.
    Delivery option for administrator Select the action to notify administrators of infected and protected attachments.

    Don't deliver: Doesn't notify administrators.

    Send original: Sends the email to administrators.

    Remove attachment: Sends the email to the recipient without the attachment. Sends a notification of removal to administrators.


    Doesn't scan protected attachments, but notifies the recipient if not specified otherwise.

  7. Click Save.