Get this font in here!
This Article Applies to:
- Avast Business Hub
We do not recommend installing this component on a server OS that is also running Microsoft Exchange. The Exchange and Anti-Spam components handle the Exchange-level filtering and will conflict with
Note that in Antivirus for macOS, the shields can only be disabled, not uninstalled. Therefore, if you uninstall Mail Shield from a policy, the service on macOS endpoints will only be disabled.
Configuring Mail Shield Settings
Windows and macOS configuration options are mixed together in the policy settings for the various components.
To access Mail Shield settings:
- Open the Policies page
- Click the desired policy to open its Detail drawer
- Select the Settings tab, then Antivirus
- Expand the Mail Shield section (under Antivirus Protection)
Seven sets of settings are available here:
- Main settings
(Windows and macOS)
- SSL scanning
- Report file
Main Settings Tab
The main Mail Shield settings offer the following options
- Inbound mail: Scans all incoming emails (POP3, IMAP4) sent using an SSL/TLS encrypted connection
- Outbound mail: Scans all outbound emails (SMTP) sent using an SSL/TLS encrypted connection
- Newsgroup messages: Scans all newsgroup messages (NNTP) sent using an SSL/TLS encrypted connection
For macOS devices, you can choose whether to:
- Enable IPv6: Scans devices using IPv6
- Scan secured connections: Scans emails sent or received over secure protocols
- Report PUPs: Checks for and notifies about potentially unwanted programs
- Mark mail headers: Adds a warning to the header of suspicious emails
- Email attachments: Removes suspicious email attachments before downloading the email
Under the General section of the Behavior tab, you can decide whether you want to:
- Insert note into clean message (incoming)
- Insert note into infected message (incoming)
- Insert note into clean message (outgoing)
- Add a warning to the subject line of infected emails
For MS Outlook only, you can also choose to:
- Show splash screen
- Scan files when attaching to email
- Scan archived messages when opening (or just the unread ones)
SSL Scanning Tab
Here, you can choose whether Mail Shield scans SSL connections.
The Actions settings define how viruses, PUPs, unwanted tools, and suspicious objects are handled when detected by File Shield. For each type, it is possible to configure three actions to perform, with the "if the action fails" value. The following actions can be selected from each drop-down menu:
- Fix automatically: Runs a sequence of actions (repair file; if not possible, then move to Quarantine; if not possible, then delete)
- Move to quarantine: Sends the threat to Quarantine, where it cannot harm your system
- Repair: Removes only malicious code attached to an otherwise safe file — this is not possible for files that are entirely malware
- Ask: Avast asks what you want to do with a detected threat before any action is taken
- Delete: Permanently remove the file from your computer
- No action: No action is taken during the scan; the threat is listed in your scan results and you can decide what to do later
For example, you can set the first action to Move to quarantine. If that fails, then Ask the user. If that then fails as well, the final action can be to Delete the file. If the final action also fails, nothing further will be performed (file will continue to be blocked).
Under the Notification section, you can also define whether a notification will be displayed each time Mail Shield detects a threat on the device.
Lastly, the Processing of infected archives option allows you to configure what to do with detected archives. By default, the shield will try to remove the infected file from the archive and if that fails, nothing will happen.
The other option (removing the whole archive if removing the infected file from the archive fails) can lead to issues if there is a false positive, and the archive may be deleted if too large.
These settings allow you to choose which archive (packer) files Avast should try to unpack during the scanning process (unpacked files can be better analyzed for malware). Original archives remain intact while processed by Mail Shield.
Here, you can adjust the sensitivity of the Antivirus scan for
- Heuristics Sensitivity: Heuristics enable Antivirus to detect unknown malware by analyzing code for commands that may indicate malicious intent. The default setting is Normal. With higher sensitivity, Antivirus is more likely to detect malware, but also more likely to make false-positive detections that incorrectly identify files as malware.
- Use code emulation: Choose whether to use code emulations to unpack and test suspected malware in an emulated environment, where the files cannot cause damage to devices.
- Sensitivity: Enable Test whole files to check the whole content of a file instead of the parts typically affected by malicious code. There is usually no need to enable this option, and it will likely impact system performance.
- PUP and suspicious files: Choose whether or not to scan for Potentially Unwanted Programs (PUPs). You can select the option separately for pre and post 21.5 and 21.6 versions of the Antivirus respectively. For versions 21.6 and newer, you can also choose whether to scan for potentially unwanted tools.
Report File Tab
You can configure the report file here in order to enhance the reporting of the shield:
Filename: Enter a name for the report file (default * will use the default file name)
- The Generate report file option needs to be enabled for the report file to be created.
Filetype: Select the format of the report file:
- Plain text (ANSI)
- Plain text (Unicode)
- If file exists: Select Append if you want new results to be added to the end of the previous report, or Overwrite if you want new results to replace the previous report
- Using the Append option will gradually increase the size of the report file on the disk. Including informative events such as OK will also greatly increase the size on the disk as every clean file will be reported.
- Reported items: Define which events appear in report files:
items— Files and areas of the scanned environment that the virus scan identifies as containing malware
- Hard Errors — Unexpected errors that require further investigation
- Soft Errors — Minor errors, such as a file being unable to be scanned because it was in use
items— Files and areas that the virus scan identified as being clean
items— Files and areas that the virus scan did not check because of the scan settings
Adding Mail Shield Exclusions (macOS Only)
If needed, you can add exclusions to the
For more information on standard and component-specific exclusions, see
The managed endpoints are designed to be controlled from the policies, therefore the important shields are inaccessible from the UI to be disabled individually. Core Shields can only be disabled together.
The local Antivirus is simplified with its controls in the UI. The user can only control all shield settings from these toggles at once, rather than individual settings for each shield.
We have the advanced controls in our managed policies to be able to configure each shield individually, which overwrites the local client settings, leading to these options being empty.
They are still configured correctly, they simply are not visible in the local client UI.
Enable the password protection of the UI (locally in unmanaged, from the policies in managed) in order to prevent the local user disabling shields.
Usually this indicates the underlying certificate of the mail server has the issue, rather than our certificate having a problem. Disabling the Mail Shield temporarily and reopening the mail client again will show the original certificate, which can be verified.
No, it cannot be disabled, unless the user disables the Mail Shield (and Web Shield). It is not an actual VPN, just the method used for scanning.
Host names will be resolved when the user attempts to add an exception - if the resolution fails, the entry will be rejected. IP addresses can be added regardless.
Other Articles In This Section: