1. Architectural Topologies: Spool Split vs Socket Stream

How an email moves through the MTA during virus and spam inspection fundamentally impacts server stability:

MailScanner (Queue Split Architecture): MailScanner decouples Postfix into two distinct instances. The first Postfix instance receives the email from the network, writes it to an incoming spool directory (/var/spool/postfix/hold), and immediately returns an SMTP 250 OK acknowledgment to the sending client. MailScanner runs as an independent daemon that periodically reads raw files from the hold directory, unpacks MIME parts, runs ClamAV/SpamAssassin, sanitizes HTML, and moves clean messages to the second Postfix outgoing queue (/var/spool/postfix/incoming) for delivery.

Amavisd-new (In-Band Loopback Stream): Amavisd-new acts as an in-line SMTP/LMTP content filter proxy. When Postfix receives a message, it holds the external client’s TCP connection open while piping the message over a local TCP loopback port (default 127.0.0.1:10024) to an Amavisd worker process. Amavisd scans the message in RAM and passes it back to Postfix via port 10025 before Postfix issues the final 250 OK acknowledgment to the remote sender.

# Amavisd-new in-band filtering loop in master.cf:
smtp      inet  n  -  y  -  -  smtpd
  -o content_filter=smtp-amavis:[127.0.0.1]:10024

127.0.0.1:10025 inet n  -  y  -  -  smtpd
  -o content_filter=
  -o smtpd_authorized_xforward_hosts=127.0.0.0/8

# MailScanner out-of-band hold configuration in main.cf:
header_checks = regexp:/etc/postfix/header_checks
# In header_checks:
# /^Received:/ HOLD

2. SMTP Connection Timeouts & Denial of Service Defense

Because Amavisd-new holds the client’s TCP socket open during deep scanning, it is vulnerable to SMTP timeouts. RFC 5321 mandates a maximum timeout of 300 seconds for the DATA termination dot (.). If a complex archive (such as a 40MB nested ZIP file or high-entropy PDF) takes longer to decompress and scan than the remote MTA’s timeout threshold, the remote sender drops the socket and immediately retries, causing an endless queue accumulation loop.

MailScanner is completely immune to SMTP timeouts. Because Postfix writes to disk and acknowledges the remote client within milliseconds, external connections are never kept waiting. If MailScanner takes 45 seconds to scan a complex document, it occurs entirely out-of-band on local disk without tying up network sockets.

3. In-Band 550 Rejection vs Asynchronous Backscatter Risk

While MailScanner wins on timeout resilience, it suffers from a major deliverability flaw: backscatter spam generation.

4. Disk I/O Queue Thrashing vs Resident Memory

MailScanner requires writing every single message to disk, unlinking it, scanning files in temp directories, and writing it back to an outgoing queue. On mechanical hard drives, this causes severe disk head thrashing and I/O bottlenecks. While enterprise PCIe NVMe SSDs mitigate this penalty, Amavisd-new remains significantly more efficient on storage hardware by streaming message payloads directly over memory sockets.

5. MailScanner vs Amavisd Technical Matrix