Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
Considering a normal e-mail volume (I don't know how can I define that) of 10000 users in a mail server does it make sense to scan emails for viruses?
I guess it should affect the server load but in what extend?
Desired answer should include pros/cons of a given approach.
You should be scanning incoming messages before they reach your end users, and you should be scanning outgoing messages before they pass from your control... but you don't necessarily need to do it at the e-mail server.
A lot of companies have a gateway appliance, separate from the e-mail server, that sits at the edge of the network and supports scanning e-mail as they pass through the appliance. Or a company could redirect their MX records through an outside service (cloud-based) such that all mail is scanned for viruses and spam, and possibly archived for compliance purposes.
You should certainly have anti-virus protection for your mail server. In fact, you should not be asking if you should get anti-virus software but asking what you need and how you need to configure it.
I am assuming you are using exchange server, given this there are specific solutions out for exchange, which typically are not CPU intensive. It will give you features such as filtering by extension type such as .exe vs. checking all e-mail attachments via signatures; this will be much less CPU intensive. You can then run scans overnight but exclude the datastores. You will not see much of a performance hit and if you choose not to use it then you are only asking for trouble.
You can also use a mail relay server that accepts incoming mail and it will scan for viruses and spam. Larger companies such as yours with a lot of users will sometimes takes this approach
(comic via xkcd)
Yes, you need antivirus on your mail server. You can outsource scanning inbound and outbound mail for viruses and other malware (as well as spam) to a number of other companies, and I recommend this approach, but even if you do, your mail server is still exposed to the threat of becoming infected by all the internal clients that you have connecting to it.
At a minimum, you need AV on your mail server to protect your mail server, and hosted solutions don't protect it from your users and client machines. Whether you use the AV to scan messages, and for what, depends on whether you have a hosted company or appliance at the gateway doing it for you. If you've got something else doing it, you may be able to skip this step, or use a less intensive scan, if you don't, you definitely need to scan emails thoroughly.
And yes, there will be a performance hit, but it's generally pretty minimal, so unless your mail server is already being crushed, adding AV shouldn't cause performance problems. However, this is (one of the reasons) why you'll want to trial different solutions from different vendors before settling on one, and one of the reasons AV vendors offer demos and trial versions for enterprise customers.
