sanesecurity - clamav - getting a false positive - should I bother?

Question

A client of mine reported that he isn't getting emails sent from our domain. This is offcourse a false positive, as we are a legitimate comapny. I am also not hearing this issue from other clients (we have over 25,000)

Some investigation shows that his email signatures are from a software called ClamAV - by http://www.sanesecurity.com/fps.htm

He claims it's a wide spread service in Europe (I am not familiar with it) - should I bother register my domain over the software vendor?

Is this locally to this client only?

Where can I start and search for a possible solution?

Answer 1

The first thing I would do is check to see if you are in a DNSBL. It sounds like that is more likely the case than the AV being a problem. I've had weird issues before where AT&T thought I was a spammer for no good reason. That seems to be the most common source of problems with mail not being delivered. I believe MXToolbox has a DNSBL checker as well as a number of other helpful tools for troubleshooting problems with e-mail delivery.

Answer 2

ClamAV is an opensource antivirus scanning engine: http://clamav.net/lang/en

Sanesecurity provide third party signature files for the ClamAV engine that are designed to catch phishing emails and other similar spam.

You should probably report false positives but only if you are sure that's the issue. He should be able to check his mail server logs to see that or given that Sanesecurity signatures are freely available to use, you could run the mails through the engine yourself.