# Spam and malware scanning

Bongo uses two independent scanners. `bongoantispam` sends mail to a standard
SpamAssassin `spamd` service for content classification. `bongoavirus` uses
ClamAV for malware detection. Neither service replaces the other.

The antispam agent is fail-open: a connection failure, malformed response or
configured size limit leaves the original message available for normal
delivery and records the problem in the log. It never sends a rejection or
bounce to the apparent sender. A successful SpamAssassin `PROCESS` response
replaces the queued copy with the processed message containing the normal
`X-Spam-*` headers and marks the envelope as already checked.

The default `antispam` JSON configuration is:

```json
{
  "version": 1,
  "enabled": true,
  "timeout": 15,
  "maximum_message_size": 52428800,
  "maximum_response_size": 53477376,
  "hosts": ["127.0.0.1"]
}
```

`hosts` accepts the existing `host:port:weight` syntax and can list several
`spamd` servers. Port 783 is used when no port is specified. The response limit
must be at least as large as the input limit because SpamAssassin adds headers.

Spam folder rules should match SpamAssassin's `X-Spam-Status` header. A high
score quarantine is deliberately not implemented through the historical
global quarantine queue: quarantine state belongs to the recipient and must be
visible and releasable through that user's task list. Until that per-user path
is active, mail is tagged and can be filed by Sieve without being destroyed.

The systemd unit only orders Bongo after common ClamAV and SpamAssassin unit
names when those services are present. It does not pull either scanner in, so
remote scanners and installations without one of the optional services remain
supported.