bongo/docs/antispam.md

Spam and malware scanning

Bongo uses two independent scanners. bongoantispam sends mail to a standard SpamAssassin spamd service for content classification. bongoavirus uses ClamAV for malware detection. Neither service replaces the other.

The antispam agent is fail-open: a connection failure, malformed response or configured size limit leaves the original message available for normal delivery and records the problem in the log. It never sends a rejection or bounce to the apparent sender. A successful SpamAssassin PROCESS response replaces the queued copy with the processed message containing the normal X-Spam-* headers and marks the envelope as already checked.

The default antispam JSON configuration is:

{
  "version": 1,
  "enabled": false,
  "timeout": 15,
  "maximum_message_size": 52428800,
  "maximum_response_size": 53477376,
  "hosts": ["127.0.0.1"]
}

hosts accepts the existing host:port:weight syntax and can list several spamd servers. Port 783 is used when no port is specified. The response limit must be at least as large as the input limit because SpamAssassin adds headers. Both scanner agents are disabled in the distribution defaults. bongo-setup enables each one only after the matching local service answers a protocol PING; bongo-admin config can configure remote endpoints explicitly.

Spam folder rules should match SpamAssassin's X-Spam-Status header. A high score quarantine is deliberately not implemented through the historical global quarantine queue: quarantine state belongs to the recipient and must be visible and releasable through that user's task list. Until that per-user path is active, mail is tagged and can be filed by Sieve without being destroyed.

The systemd unit only orders Bongo after common ClamAV and SpamAssassin unit names when those services are present. It does not pull either scanner in, so remote scanners and installations without one of the optional services remain supported.