Re: What does "UNCHECKED" really mean?

Damian <[email protected]> Wed, 18 Jun 2025 11:23:21 +0200
Newsgroups gmane.mail.virus.amavis.user
Message-ID <[email protected]> 
This is a multi-part message in MIME format.
--------------zQcYKEF06pSMIA18iYGWSVqH
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

> It looks like the source of my confusion was the assumption that the 
> addition of the header "X-Virus-Scanned: Debian amavis at tait.net.nz" 
> to the message meant that the message had been virus-scanned

If your ClamAV instance runs with "ScanMail true", and your Amavis 
instance's @keep_decoded_original_maps include MAIL-UNDECIPHERABLE 
(which they do in upstream as well as on Debian), then the message had 
been virus-scanned. But Amavis does more than virus-scanning. For 
example, one might have @banned_filename_maps that do not indicate 
viruses per se. If Amavis detected (potentially) ambiguous content, it 
means that it might see different filenames than the receiving MUA, so 
the message is considered unchecked as a whole.

--------------zQcYKEF06pSMIA18iYGWSVqH
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <blockquote type="cite"
      cite="mid:[email protected]">It
      looks like the source of my confusion was the assumption that the
      addition of the header "X-Virus-Scanned: Debian amavis at
      tait.net.nz" to the message meant that the message had been
      virus-scanned</blockquote>
    <p>If your ClamAV instance runs with "ScanMail true", and your
      Amavis instance's @keep_decoded_original_maps include
      MAIL-UNDECIPHERABLE (which they do in upstream as well as on
      Debian), then the message had been virus-scanned. But Amavis does
      more than virus-scanning. For example, one might have
      @banned_filename_maps that do not indicate viruses per se. If
      Amavis detected (potentially) ambiguous content, it means that it
      might see different filenames than the receiving MUA, so the
      message is considered unchecked as a whole.<br>
    </p>
  </body>
</html>

--------------zQcYKEF06pSMIA18iYGWSVqH--