Considering a normal e-mail volume (I don't know how can I define that) of 10000 users in a mail server does it make sense to scan emails for viruses?

I guess it should affect the server load but in what extend?

Desired answer should include pros/cons of a given approach.

  • 1
    This is why you can outsource it to organisations like Postini
    – Steve-o
    Aug 28, 2012 at 13:49
  • @Steve-o - oh well another google tm
    – pl1nk
    Aug 28, 2012 at 14:09
  • @Steve-o NO, you cannot. You can have them scan inbound and outbound emails for malware, but that does no good if the server itself gets infected or wiped by a virus. Aug 28, 2012 at 14:58
  • @HopelessN00b that is illogical, you have a firewall in front of the mail server that only permits forwarding to your anti-virus SMTP relay.
    – Steve-o
    Aug 28, 2012 at 16:57
  • 1
    @HopelessN00b If your mail server can itself get infected from a message attachment, something is wrong with your mail server. Attachments are just payloads. The server shouldn't be doing anything other than moving bytes from one location to another.
    – Joel Coel
    Aug 31, 2012 at 13:43

3 Answers 3


You should be scanning incoming messages before they reach your end users, and you should be scanning outgoing messages before they pass from your control... but you don't necessarily need to do it at the e-mail server.

A lot of companies have a gateway appliance, separate from the e-mail server, that sits at the edge of the network and supports scanning e-mail as they pass through the appliance. Or a company could redirect their MX records through an outside service (cloud-based) such that all mail is scanned for viruses and spam, and possibly archived for compliance purposes.

  • I would argue that this practice doesn't make your mail server immune from requiring virus protection. Maybe you could exclude the mail store to reduce load. (Such as suggested below.) But, this seems to be inviting some bonehead SA to use IE on the mailserver to download a patch/update and get caught with a XSS/trojan dropper. Aug 31, 2012 at 15:07

You should certainly have anti-virus protection for your mail server. In fact, you should not be asking if you should get anti-virus software but asking what you need and how you need to configure it.

I am assuming you are using exchange server, given this there are specific solutions out for exchange, which typically are not CPU intensive. It will give you features such as filtering by extension type such as .exe vs. checking all e-mail attachments via signatures; this will be much less CPU intensive. You can then run scans overnight but exclude the datastores. You will not see much of a performance hit and if you choose not to use it then you are only asking for trouble.

You can also use a mail relay server that accepts incoming mail and it will scan for viruses and spam. Larger companies such as yours with a lot of users will sometimes takes this approach

xkcd - Network

(comic via xkcd)

  • I'm not using exchange server, my question is general if using a virus scanner in a mail server is ok favorably along with the prons/cons.
    – pl1nk
    Aug 28, 2012 at 13:41
  • @pl1nk understood, but the overall aspects remain the same. It is always a good idea to use antivirus software and you will not see much of a performance hit if properly configured. As Joel Coel mentioned as well, many large companies use appliances on the edge of the network.
    – JMeterX
    Aug 28, 2012 at 13:46
  • You win 10 internets for the inclusion of the XKCD cartoon.
    – gWaldo
    Aug 28, 2012 at 17:02

Yes, you need antivirus on your mail server. You can outsource scanning inbound and outbound mail for viruses and other malware (as well as spam) to a number of other companies, and I recommend this approach, but even if you do, your mail server is still exposed to the threat of becoming infected by all the internal clients that you have connecting to it.

At a minimum, you need AV on your mail server to protect your mail server, and hosted solutions don't protect it from your users and client machines. Whether you use the AV to scan messages, and for what, depends on whether you have a hosted company or appliance at the gateway doing it for you. If you've got something else doing it, you may be able to skip this step, or use a less intensive scan, if you don't, you definitely need to scan emails thoroughly.

And yes, there will be a performance hit, but it's generally pretty minimal, so unless your mail server is already being crushed, adding AV shouldn't cause performance problems. However, this is (one of the reasons) why you'll want to trial different solutions from different vendors before settling on one, and one of the reasons AV vendors offer demos and trial versions for enterprise customers.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .