Open Security settings

Open Settings → Security. Valid changes save automatically with a toast; Save settings remains a fallback. Attachment Scanning is on by default. URL Scanning and Advance Email-Address Check are off until configured with the required API key and enabled.

AeroMailer interface: Configure Email Security and verify incoming messages
Sample-data app screenshot. Select the image to view it at full size; your accounts and content will differ.

Attachment Scanning and updates

  1. Confirm that ClamAV and current virus definitions are ready. The official setup can download/install ClamAV online. If missing, use Install ClamAV to repair setup.
  2. Click Update virus definitions for the latest official signatures; internet access is required. This updates definitions, not the scanner engine.
  3. Keep Attachment Scanning enabled to scan received cached attachments locally. Files are not executed or uploaded by this scanner.
  4. Right-click an Inbox message and choose Verify email safety to scan the attachments again.

Missing/outdated definitions, encrypted files, errors and scan limits cannot be treated as clean. No known warning is not a safety guarantee.

Optional URL Scanning

Use the question-mark/help guide in Settings for Google Web Risk setup and the official documentation link. Add your own key and enable URL Scanning. It checks links in email messages only, not links inside PDFs, Word files or other attachments. Enabled automatic checks and Verify email safety use the configured service without opening the links.

Full email URLs, including any private query tokens, are shared with Google. Provider quotas, billing and key restrictions apply. When disabled or no saved key exists, the URL Scanning section is hidden from safety results.

Manual advanced sender-address checks

Select EmailRep or IPQS, use the setup guide, add your own key, and enable Advance Email-Address Check. Then right-click a message and choose Verify Email Address. This action appears only when enabled and configured; sender reputation checks never run automatically. The sender address is shared with that provider, whose quotas, charges and integration terms apply.

Read safety results carefully

Verify email safety shows available stored authentication headers and enabled scan results. It reports what the mail server supplied; it does not independently authenticate a sender or manufacture missing SPF/DKIM/DMARC results. A DKIM signature alone is not a verified pass. Reputation, authentication and content scans are different signals: none guarantees an email, attachment or website is safe. Do not open suspicious files or disclose credentials just because a scan has no warning.

Basic Security and certificate checks

Basic Security is on by default and can warn automatically about sender-authentication failures and suspicious content. An unavailable authentication result alone does not prove that a message is unsafe or safe. Dismiss hides a warning without changing the scan result. Certificate status lookup (OCSP) is on by default; confirmed revoked certificates are blocked. If status is unavailable, normal certificate checks still apply. See OpenPGP for message encryption, which is separate from TLS and Inbox scans.