0

A client of mine reported that he isn't getting emails sent from our domain. This is offcourse a false positive, as we are a legitimate comapny. I am also not hearing this issue from other clients (we have over 25,000)

Some investigation shows that his email signatures are from a software called ClamAV - by http://www.sanesecurity.com/fps.htm

He claims it's a wide spread service in Europe (I am not familiar with it) - should I bother register my domain over the software vendor?

Is this locally to this client only?

Where can I start and search for a possible solution?

4
  • 3
    ClamAV is an opensource antivirus scanning engine: clamav.net/lang/en SaneSecurity provide third party signature files for it that are designed to pickup phishing emails and other similar spam. You should probably report false positives but only if you are sure that's the issue. He should be able to check his mail server logs to see that.
    – ewanm89
    Commented Nov 25, 2012 at 14:39
  • 1
    Also the sanesecurity signature files are freely available, so you could try to run them yourself.
    – ewanm89
    Commented Nov 25, 2012 at 14:39
  • @ewanm89 - you could probably make an answer from your 2 comments :-)
    – Rory Alsop
    Commented Nov 25, 2012 at 15:38
  • Sanesecurity added our entire domain range, .ourcompany.com, as a virus. Note, not a single server, but every single server prefixed with anything e.g. serverxyz.ourcompany.com. What's more it's a false positive as only one server was affected by a spamming incident. The message they provide: Sanesecurity.Jurlbl.1da0d7.UNOFFICIAL I have tried fruitlessly to tell them it's a false positive. They don't respond to emails and there is no ticketing system. I'm loosing business all the time. In my opinion, you should take Sane Security very serious because they can destroy your reputation. Commented Jul 9, 2020 at 3:32

2 Answers 2

1

ClamAV is an opensource antivirus scanning engine: http://clamav.net/lang/en

Sanesecurity provide third party signature files for the ClamAV engine that are designed to catch phishing emails and other similar spam.

You should probably report false positives but only if you are sure that's the issue. He should be able to check his mail server logs to see that or given that Sanesecurity signatures are freely available to use, you could run the mails through the engine yourself.

1

The first thing I would do is check to see if you are in a DNSBL. It sounds like that is more likely the case than the AV being a problem. I've had weird issues before where AT&T thought I was a spammer for no good reason. That seems to be the most common source of problems with mail not being delivered. I believe MXToolbox has a DNSBL checker as well as a number of other helpful tools for troubleshooting problems with e-mail delivery.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .