A guide to installing and using MailScanner, and a complete training manual describing its operation and use by Julian Field.

Now available for free in PDF format!

Updated June 2007

Download for free here!

A Free Anti-Virus and Anti-Spam Filter
Cleaning e-mail in 225 countries
Over 1.3 million downloads
Keep up to date on the latest version info and news right here on the official MailScanner web site
Version 4.85.2-1 Released 29 March 2015
What Is MailScanner?
29/03/2015 - v4.85.2-1 Released - Too many updates to list. See The Change Log.
07/12/2012 - New 3rd Party Product: Mailborder, a clusterable gateway based on MailScanner, enters open beta for current MailScanner users.
10/11/2012 - Released 4.84.5-3 with fix so that clamd will no longer report a virus in MessageBatch.pm.
01/05/2012 - The "MailScanner User Guide and Training Manual" is now available for free in PDF format!
09/03/2011 - News update: Many apologies for the continued updates service outage, we are working with the CDN operators as fast as they will respond to get this service back up and running normally. Thank you for your patience everyone!
05/03/2012 - Important Update: due to a domain expiring, the links to www.mailscanner.tv must now point to cdn.mailscanner.info instead. This is in update_bad_phishing_sites and update_bad_phishing_emails which are both scripts you can easily edit. As an alternative I have released a new version with these updates.
If you edit the files yourself, delete the directory /var/spool/MailScanner/quarantine/phishingupdate before re-running those 2 scripts.
20/08/2011 - Released 4.83.3 stable with a few remaining fixes, mostly for mktemp bugs.
25/06/2011 - Released 4.84.1 beta to avoid taint errors in new versions of Perl.
17/04/2011 - Issued bug-fix release to get zipfile permissions correct.
23/03/2011 - Issued bug-fix release to handle new SpamAssassin "RP_8BIT" rule correctly. Updating your systems is strongly recommended.
30/01/2011 - Released 4.82.4 beta with bugfixes. See the Change Log for details.
18/10/2010 - I would like to welcome our new sponsor IGAware Network Appliance Solutions !
9/11/2010 - Released new beta with greatly improved automatic attachment file renaming. See the Change Log for details.
9/11/2010 - Released new beta with automatic attachment file renaming where required.
6/9/2010 - Finally released 4.81 stable release! Thank you for your patience.
15/8/2010 - Released a new beta with the _HOUR_ keyword in "Archive Mail" and "Spam Actions" and all its variations.
3/8/2010 - Released a new beta, stable release imminent.
3/6/2010 - New configuration database connector announced and released in the latest beta, 4.80.7.
29/4/2010 - Press release celebrating 10th anniversary of MailScanner and announcing ScamNailer.
22/2/2010 - Released beta version 4.80.3. See the Change Log for more information.
1/2/2010 - Released stable version 4.79. Please see the Change Log for all the details.
27/1/2010 - ClamAV+SpamAssasssin package updated to ClamAV 0.95.3 and SpamAssassin 3.3.0. Fetch it from the Downloads page.
22/1/2010 - MailScanner enters Grand Theft Auto: Chinatown Wars! In the game, look in the Inbox in the "in-game" PDA. In there you will see the famous "(SPAM?)" Subject: line tag. Only MailScanner does this. Take a look at the screenshot!
14/1/2010 - ClamAV+SpamAssassin package updated to ClamAV 0.95.3.
8/11/2009 - Released new beta release with updated HTML-Parser module.
12/10/2009 - Launched ScamNailer in its own website, it is my anti-spear-phishing code. It does not require MailScanner to run, so can be a separate package in its own right.
1/10/2009 - New stable release 4.78.17. Quite a few new features this month, please check the Change Log for details and information.
26/8/2009 - Have implemented "include" directive in MailScanner.conf so you can include other config files so you can keep all your local settings in the /etc/MailScanner/conf.d directory and not have to touch the MailScanner.conf file itself, or do any upgrade_MailScanner_conf step when upgrading at all.
11/8/2009 - Added support for "include" lines in MailScanner.conf files. Nested "include"s are accepted, as are wildcards in the pathnames to the included configuration files.
4/8/2009 - Updated MailScanner to install nicely on Fedora Core 11.
31/7/2009 - Beta 4.78.3 released. This has support for "spam-viruses" which are spam messages which are detected and reported by your virus scanner, such as ClamAV and F-Prot 6. This has involved some major re-arrangement of the structure, so virus scanning is now done before spam checking, instead of after spam checking.
1/6/2009 - Released new stable version 4.77. The biggest new feature is that you can now specify hostnames and domain names instead of IP addresses in ruleset lines. You can also use wildcards and Perl regular expressions here too. There are various other new features and fixes as detailed in the ChangeLog.
12/5/2009 - Bug-fix release of 4.76 to resolve a couple of issues which have appeared since the stable release.
4/5/2009 - You can now follow me at twitter.com/JulesFM.
3/5/2009 - Fedora Core 10: Upgrades are no longer supported, the RPM Perl module build environment is fundamentally broken. Perl modules will not build reliably. If you want to do this, then just use "yum" to update all the Perl modules by hand and then do "./install.sh --nomodules".
1/5/2009 - New stable release of version 4.76. Major new features this month are totally separate handling for files within archives from those attached directly to the message, and a greatly improved installer. Also several optimisations and many other improvements. See the (long) Change Log for more information.
29/4/2009 - Mailing list has been out of action for some time this afternoon. Very sorry for this, it will be back online shortly.
13/4/2009 - Done a lot of work on the installer, so that it no longer interferes with your ability to upgrade Perl, and does not "force" the installation of any Perl modules at all.
11/4/2009 - Borrowed some tricks in building Perl modules RPMs from Dag Wieers, to enable them to be installed in the "vendor" tree and not the "core" tree, so the RPMs don't have to be force-installed.
1/4/2009 - Released 4.76.3 beta with a fix for Apple Mail's utterly broken MIME structure when using "Add Text Of Doc = yes". Also contains all the new code for handling attachments within archives differently from attachments not contained within archives.
1/4/2009 - Released stable release of 4.75. The next version to be released will contain all the implementation of different handling for attachments within archives, from those not in archives.
28/3/2009 - Released beta (about to release stable), for final testing. This is to get a stable release out the door before I break everything, as I have started implementing support for different filename and filetype rules within different sorts of archives.
1/3/2009 - Crash Protection: I have finally got around to implementing the crash protection system that has been discussed on the mailing list. If a bug in Perl or another external piece of code causes MailScanner to crash (it's rare, but it is just possible), and the same message causes it to crash repeatedly, then the message is rejected and quarantined. Take a look at the latest betas for this feature.
17/1/2009 - Solve "Spear Phishing" attacks completely.
12/1/2009 - A few minor problems have cropped up in the latest 4.74 release, so I have fixed them and released 4.74.16.
8/1/2009 - Fedora 10 is now supported in the RedHat RPM distribution of MailScanner. You will need to download the very latest version from the MailScanner downloads page.
3/1/2009 - A couple of days late, but here is the first release for 2009. Major fix this release: all the symlink vulnerabilities have gone, despite the fact they were never exploited anyway, but I really do care about the security of MailScanner. Other than that, minor feature improvements.
15/12/2008 - Released a new beta. This not only includes fixes for all the potential symlink attack vulnerabilities (do people really let arbitrary users logon to their mail servers?), but also includes some fixes to the handling of complex "SpamAssassin Rule Actions" settings.
7/12/2008 - Released updated ClamAV+SpamAssassin easy-to-install package including a patch to the Mail::ClamAV Perl module, which is used by the "clamavmodule" virus scanner. This patch provides support for ClamAV 0.94 in this scanner.
1/12/2008 - Released stable version 4.73. I strongly advise everyone running 4.71 or 4.72 to upgrade to this release to fix a partial Denial-of-Service vulnerability in those versions.
27/11/2008 - There was a problem with 4.72 where it could hang if sent a particular type of message. My mistake, mea culpa. This release fixes that problem. I strongly advise all 4.72 and 4.73 users to upgrade to this release.
22/11/2008 - Released beta version 4.73 for testing. This incorporates the new trend-autoupdate script, for those of you who use the Trend virus scanner.
22/11/2008 - Security vulnerability discovered in MailScanner: A security vulnerability has been discovered in MailScanner's 'trend-autoupdate' script. This only affects users who have the "Trend" anti-virus scanner installed. If you do not have the "Trend" anti-virus scanner installed, this does *not* affect you as this script will never be run.
If you do have the "Trend" anti-virus scanner installed, you can download a replacement file from trend-autoupdate.tar.gz. Simply unpack this file and copy it over the top of your existing trend-autoupdate script, which is probably in either /usr/lib/MailScanner or /opt/MailScanner/lib. Replacement complete packages of MailScanner will be released shortly, in case you do not want to do the simple procedure above.
5/11/2008 - Upgraded ClamAV+SpamAssassin package to ClamAV 0.94.1. See the downloads page for links.
1/11/2008 - Released new stable release 4.72. Quite a few changes in this release, please see the ChangeLog for more details.
16/9/2008 - Released beta 4.72.2. This allows you to use the "deny+delete" rules in filename.rules.conf and filetype.rules.conf to selectively delete files from your work directory before they are virus scanned, so you won't accidentally choke any buggy virus scanners.
1/9/2008 - Released new stable version 4.71. This includes a new feature which can extract the text of *.doc documents (see "Add Text Of Doc" in MailScanner.conf), updates to the support of many virus scanners and protection against attacks on the HTML parser. Well worth upgrading, your users will love you for "Add Text Of Doc = yes"!
04/08/2008 - Released new beta version containing protection for the HTML::Parser module that can be killed by over-nested HTML tags in messages. Note this contains a new 'languages.conf' file so you will need to run "upgrade_languages_conf" after upgrading to this version.
30/07/2008 - Released new beta version with support for F-Secure 7.01 and Eset 3.0.
17/6/2008 - Released stable version 4.70.6. Unusual date for a stable release, but I didn't release at the start of this month, so it has been a while. There are quite a few changes now too.
9/6/2008 - Released new beta version 4.70.3, which should resolve all outstanding problems with Watermarks. Upgraded easy-to-install ClamAV+SpamAssassin package to ClamAV 0.93.1.
6/6/2008 - Please vote for MailScanner in the SourceForge Awards by clicking here:
4/5/2008 - Updated 4.69 with a fix for PPS Errors from Word document unpacking.
1/5/2008 - Released new stable version 4.69. Please see the Change Log for details on new features and improvements.
30/04/2008 - Guide to installing MailScanner with Ubuntu Linux now available.
6/4/2008 - Major new feature: MailScanner can now extract files embedded within Microsoft Office documents, and subject them to all the same filename/type checks and other checks applied to files contained within other archive files. Released beta version 4.69. No configuration changes are required to use this new functionality. Please see the Change Log for more information.
1/4/2008 - Released stable version 4.68. This is not an April Fool's joke, it's the real thing :-). Please see the Change Log for more information.
12/3/2008 - Released major new beta version 4.68.3. See the Change Log for the low-down.
4/3/2008 - Released stable version 4.67.6. This includes many new features and improvements, please see the Change Log for more details.
2/3/2008 - Released beta version 4.67.5. This is the final beta just to check things are okay before the stable release of 4.67 in a day or two's time.
14/2/2008 - Happy Valentine's Day! If anyone wants to express their gratitude, I have updated my Amazon.co.uk wishlist. Thanks all! :-)
13/2/2008 - Released updated version of ClamAV+SpamAssassin package including ClamAV 0.92.1.
16/1/2008 - Released updated ClamAV+SpamAssassin package including the new release of Mail::ClamAV 0.21.
2/1/2008 - Released new stable version 4.66. Please see the Change Log for more information.
20/12/2007 - I have updated the easy-to-install ClamAV & SpamAssassin package in 2 ways: (1) I have included the latest ClamAV 0.92. (2) I have patched the Perl module Mail::ClamAV so that it will build with the latest ClamAV 0.92. (3) I have added SpamAssassin patch 5589 to SpamAssassin 3.2.3 to save you having to mess with the "patch" command and building the package manually to get decent DNS lookup performance from it. See the downloads page for the link to download it all.
19/12/2007 - I have patched the Perl module Mail::ClamAV so that it compiles successfully with the latest ClamAV 0.92 installed. You can download my patched version here. To use it, download and install the ClamAV 0.92 & SpamAssassin package, build and install it as usual (expect Mail::ClamAV to fail to install) and then unpack and install the patched version of the Mail::ClamAV package you just downloaded. Let me know how you get on with this.
18/12/2007 - New version of ClamAV 0.92 is out, please download and install the updated ClamAV+SpamAssassin package. update: backed off to previous version as latest will not build with Mail::ClamAV required for "clamavmodule" virus scanner.
1/11/2007 - Released new stable version 4.65. Includes support for the very latest F-Prot and F-Secure versions.
22/9/2007 - Released first beta of 4.64.
3/9/2007 - The MailScanner book is now available for purchase in the EU. Save shipping costs and get it faster!
1/9/2007 - Stable release 4.63.7. Major new features are support for F-Prot version 6, and "Phishing Bad Sites File" which is a list of manually checked compromised web sites being actively used in phishing fraud attacks.
29/8/2007 - Interesting little article about MailScanner from Linux.com. The comments added to it are well worth reading too.
7/8/2007 - Released 4.63.1 beta. Major new feature for protecting your users: a live continuously updated list of known compromised websites which have been manually tested and are known to have been compromised or "0wn3d" ("owned"). These will always trigger the phishing net.
1/8/2007 - Released new stable version 4.62. Far too many new features to go into here, but highlights include SpamAssassin Rule Actions to do anything based on the detection of any attribute of a message, the new "custom()" spam action, watermarking to do the job of milter-null, graphical signatures, and so on..
25/7/2007 - Released updated version of ClamAV+SpamAssassin package containing new SpamAssassin 3.2.2.
24/7/2007 - Released 4.62.4 beta with a new configuration setting 'SpamAssassin Rule Actions', which replaces most of the functionality of MCP but has no speed overhead.
11/07/2007 - Released updated ClamAV+SpamAssassin package containing the new ClamAV version 0.91.
1/7/2007 - Released new stable release 4.61. Top two items this month are direct support for the "clamd" virus scanning daemon for faster scanning, and important bug-fixes in the attachments auto-zip feature introduced last month.
26/6/2007 - Released new beta of 4.61 including Postfix milter bugfix.
14/6/2007 - Released beta 4.61.3. Some Postfix problems fixed, among other things.
9/6/2007 - Released updated version of the MailScanner Book. It is now up to date with version 4.61, the latest release.
2/6/2007 - Released beta 4.61.1. This includes support for direct communication with clamd and so should be considerably faster than the clamd support in version 4.60. Thanks to Rick Cooper for this.
1/6/2007 - Released stable version 4.60.8. Major new feature this month is the ability to compress all the attachments into a zip file, thereby saving space on mail servers when people attach large uncompressed files to messages.
30/5/2007 - Postfix patch fix for Postfix 2.3 and 2.4. Please would Postfix users help test this for me!
27/5/2007 - New feature: Replace all a message's attachments with a zip file containing them.
25/5/2007 - New beta release including patches for "p record" support in Postfix 2.3 and Postfix 2.4.
21/5/2007 - Released another beta. Previous beta has major bug (sorry!) in RBL code. This bug was not present in the last stable release, so no reason to replace your stable installations.
20/5/2007 - Released another beta. Updated a whole bunch of the required Perl modules and there is now a "--nomodules" command-line option to skip the installation of the required Perl modules.
19/5/2007 - Released first beta of 4.60. See Change Log for details..
8/5/2007 - Improved install.sh script in ClamAV+SA package so it asks whether to build and install ClamAV or not. So you can now use an RPM build of ClamAV which will be very useful on Linux systems if you are using the "clamd" scanner.
1/5/2007 - Released new stable version 4.59.4. Main new feature this month is support for the command-line and daemon versions of the Avast virus scanner. Other changes are listed in the Change Log.
27/4/2007 - Released beta version 4.59.3 including support for clamd as another fast way of using ClamAV without depending on the Mail::ClamAV Perl module.
16/4/2007 - Support for ClamAV 0.90: Released updated version of the ClamAV and SpamAssassin package. This contains the latest versions of ClamAV (0.90.2) and the Mail::ClamAV Perl module (0.20) required for the "clamavmodule" virus scanner. You also need to make one change to your MailScanner.conf file: "Monitors for ClamAV Updates = /usr/local/share/clamav/*.inc/* /usr/local/share/clamav/*.cvd"
1/2/2007 - Released stable version 4.58. Many changes and improvements this month, please see the Change Log for more information.
30/1/2007 - Added configuration option to control delivery of notifications to senders of bad-size attachments, particularly 0-length attachments created by broken viruses.
28/1/2007 - Okay, this really is the last release before the stable release. The split-queues message kicking code is in, but will come out again if it proves troublesome.
28/1/2007 - Very particular circumstance may cause non-disarmed message to be tagged disarmed in the Subject: line bug has been fixed. New beta released.
23/1/2007 - Reached the 1 millionth download! Also released new beta version, in preparation for a new stable release in a week.
4/1/2007 - Have fixed long-standing bug where {Fraud?} tag would not appear where appropriate, and have demonstrated how to call a ruleset from within a Custom Function. Please test this, I intend producing a new stable release shortly.
17/12/2006 - Release 4.58.2. Do not use 4.58.1, it has a bug. If you are running this version, upgrade to 4.58.2. It should fail safe but some of your configuration settings may not work as intended, depending on what Perl version you have.
16/12/2006 - New beta release 4.58.1, a few minor changes mostly for specific customers.
2/12/2006 - Release of stable version 4.57.6. New "Max Spam Check Size" setting and "Modify Subject" settings can take "end" value.
27/11/2006 - Release Candidate 1 for 4.57 which should be released on 1st December.
30/10/2006 - Released Beta 4.57.3 to add various new features as requested by users. Next stable release planned for 1st December as it's now too late to do 1st November release.
17/10/2006 - Upgraded ClamAV+SpamAssassin easy-to-install package to ClamAV 0.88.5.
9/10/2006 - Released updated version with fix for bug when using things like "40k" in the "Max SpamAssassin Size" setting.
1/10/2006 - Release stable version 4.56. New this month: control of reports sent to senders of "too large" messages, Postfix 2.3 support, fine control of maximum size of message section sent to SpamAssassin, significant improvement to reliability of tnef extraction utility.
>>> MORE <<<

MailScanner would like to thank the following for their support:


MailScanner web site: Locations of visitors to this page

Copyright 2006 © Julian Field/Mailscanner