Viruses and phishing
never reach
the recipient

Checked before delivery,
not after

Antivirus and anti-phishing run right at the gateway while the message is being received. An infected email is rejected before it ever reaches your mail server.

1. 1
   The email arrives at the gateway

   Still within the SMTP session, the gateway receives the message body and all attachments for analysis.
2. 2
   Antivirus scan

   ClamAV checks every attachment against its signature database. Rspamd analyzes links in the body for phishing and suspicious patterns.
3. 3
   Threat found — rejected

   A virus or phishing attempt is detected — the message is rejected with SMTP code 550. It never reaches your server at all.