In our company we use a hosting provider for e-mails and it seems they don't scan incoming email against viruses. And our employees does not very careful about attachments... So we deal with virus infections from time to time. (TorrentLocker and Cryptolocker nowadays)

I would like to do virus scan at network level, and I expect this appliance/system to stop infected incoming e-mails which are stored/managed in our hosting providers servers before they can reach our employee computers.

How can I scan hosted incoming POP3 or IMAP e-mail for viruses? Can I use UTM/proxy appliance or software for this purpose (Sophos UTM Essential, Endian etc. there are several free ones for business use)?

Does anyone use such system?

4 Answers 4


Scanning POP3 traffic for viruses is mostly easy, because the mails are transmitted in full. There are free solutions which can traffic (provided that you have a virus scanner which is mostly not free) and most better (deep inspection) firewalls are able to do this.

IMAP instead is much harder, because mail clients often don't get the full mail at once but only the parts they need at the moment. Typical examples are Thunderbird which gets big attachments in parts and Apple Mail which gets first the mail structure and then each part separately. If you only do passive network analysis (like most firewalls do) you are missing context like the content-transfer-encoding which is important for scanning the attachments.

Therefore lots of firewalls either don't support IMAP at all (like Sophos UTM), have documented limits which point to serious implications in real usage once you understand them (see "Understanding IMAP Antivirus Scanning Limitations" for Juniper Firewalls) or claim to have support for IMAP but probably don't know what they are talking about (or are silent about the limits). Secure inline IMAP scanning instead needs application level gateways (ALG) which not only inspect traffic but can manipulate it so that they have enough context. The passive deep inspection you have in most NGFW (Next Generation Firewall) or UTM (Unified Threat Management) might be sufficient for demonstrations but not for real life.

Some firewalls don't offer inline IMAP scanning but instead mirror the IMAP accounts, scan new mails and provide the mails with an IMAP server at the firewall itself. In this case the credentials of the original IMAP account need to be stored at the firewall and the user gets different credentials to access the firewalls IMAP server.


If you are a mail provider, you can try to hook in an antivirus scanner before the mail system delivers locally. Most smtp packages have a process map where you can find a way to do this, as opposed to a huge monolithic program that does end to end delivery. In this way you can invoke the av. But this also means more resources are taken up by your system.

The use of gateway appliances takes away the configuration rigmarole of tweaking software. But being able to do so helps very much with understanding and appreciating the differences between competing products and the open source offerings. So, as long as you are able to redirect the incoming mail - through mx records, rewriting, etc. - you can pipe the contents through an av scanner or invoke something similar. The commercial products use some parts of the same list for their signatures as the open source ones, so what you're buying with a commercial product is the ability to get someone to look at the problem.


Yes its possible. For example Copfilter ( http://www.copfilter.org ) does this. Its possible even with a provider which does mandatory SSL, by simply having the Connection to be terminated at the UTM.

Since there is open-source solutions to the problem you are describing, I bet there is similiar "professional" solutions too. You could check BlueCoat for network level antivirus, and theres many similiar Products out on the market.


For most companies this is not something you want to get for free. Security of your business network should be handled by proper software/hardware these days, given the rise of the hacker regime.

Even smaller businesses these days use some type of mail gateway. I would purchase something like Symantec Mail Gateway ( formally brightmail ) to handle the content filtering. A proper content filter is only as good as the databases it checks against, and SMGs are second to none. There are any number of other players in this arena that companies go with, google is your friend here.

You are going to find that the results with a paid solution are better, and having support is nothing to be sneezed at.

Whatever solution you choose, I wouldn't let executables of any kind through, and limit that attachment types you accept. This will go miles towards keeping email from being and intrusion vector.

You must log in to answer this question.