Summary
False positive phishing detections by antivirus software, such as Avast, can significantly disrupt email deliverability, even for legitimate B2B communications with strong authentication. This typically occurs when an antivirus system flags benign content or links as malicious, despite proper email configurations like DMARC, SPF, and DKIM alignment. Resolving these issues often requires direct engagement with the antivirus vendor, as they maintain their own proprietary databases and algorithms.
Key findings
- Sender reputation: Even senders with excellent overall reputation (e.g., with Microsoft, Google Postmaster Tools) can experience isolated false positive detections by specific antivirus software like Avast. A sudden bad IP reputation is not necessarily an indication of a true positive for phishing.
- Email authentication: Proper DMARC, SPF, and DKIM alignment, even with a quarantine policy, does not guarantee immunity from false positive phishing detections. Antivirus solutions often employ additional layers of content and link analysis. It is important to have these standards implemented correctly though, for example, by avoiding DMARC verification failures.
- Link and content analysis: False positives can occur even when all email links point to the sender's own secure (HTTPS) domain, and the content appears benign. Traditional spam and phishing checkers like Barracuda and SpamAssassin may not detect these specific Avast-related issues.
- Geographic impact: False positive listings can be scattered geographically, affecting recipients in specific regions or countries, rather than globally.
Key considerations
- Direct reporting: The primary method to resolve Avast false positives is to report them directly to Avast. They maintain their own internal databases and are the sole authority for de-listing.
- Reporting channels: Utilize official Avast reporting channels, such as their false positive file form and relevant support email addresses (e.g., customer.support@avast.com, support@business.avast.com), to increase visibility and response time.
- Evidence submission: When reporting, include comprehensive evidence such as marked-as-phishing email headers (after passing AV filters) and screenshots of the Avast warning, particularly noting any specific codes displayed in the bottom left corner.
- Business email usage: Submitting the report from a business email address (associated with the affected domain) may lend more credibility and attention to the issue compared to a generic address.
- Persistent follow-up: Be prepared for a potentially lengthy process involving persistent follow-up. Escalation, sometimes to higher-level contacts or even CEO-to-CEO communication, may be necessary to prompt action from antivirus vendors.
What email marketers say
Email marketers often face significant frustration when dealing with false positive phishing detections, especially from prominent antivirus programs like Avast (and AVG, which is now the same company). Their experiences highlight the challenging and often time-consuming nature of getting these legitimate emails and domains de-listed from internal blocklists (or blacklists). Despite robust email authentication and content checks, these issues persist, underscoring the need for persistent communication and escalation with antivirus providers. Some also report that the initial support level may not be equipped to handle these complex false positive cases, requiring sustained effort to reach someone who can actually resolve the problem.
Key opinions
- Support challenges: Many marketers report that getting false positives resolved is an insane process, often requiring multiple attempts and escalations (including CEO-to-CEO messages) to get a response and resolution.
- Initial pushback: There's a common experience where initial support responses from antivirus vendors may incorrectly claim the flagged link or file is indeed malware, even if it's a legitimate product page or website link.
- Persistence is key: The consensus is that continuous, polite, and well-documented follow-up is necessary. Sending reports multiple times (e.g., hourly) until a response is received has been suggested as a tactic.
- Broad impact: False positives, even for a single antivirus provider, can significantly disrupt business operations and user access, causing considerable inconvenience for both senders and recipients.
Key considerations
- Multi-channel reporting: To increase the chances of a quicker resolution, marketers should consider simultaneously using the antivirus vendor's web form and direct email support channels.
- Comprehensive documentation: Always provide detailed information, including screenshots of the Avast warning with any specific codes visible, and email headers of the flagged message. This helps the support team investigate more effectively.
- Leverage business credentials: If possible, have the customer or the affected business report the issue using their official business email address. This can add weight to the report.
- Anticipate delays: Marketers should prepare for the possibility that resolution may not be immediate. It can take several days of consistent effort to get a positive outcome.
- Review other phishing warnings: While dealing with Avast, it's also prudent to review if your emails are triggering phishing warnings in other environments like Gmail or Outlook, as these might indicate broader issues.
Marketer view
Email marketer from Email Geeks indicates they have a customer sending B2B emails that are being tagged as "phishing" by Avast AV, despite having a DMARC quarantine policy and full SPF/DKIM alignment. All creative links point to the from domain and have no known reputation issues.
Marketer view
Email marketer from Email Geeks clarifies that all links in the affected emails are secure (HTTPS) and are part of the sender's own domain. The company sends a large volume of emails (around 2.5 million per month) with excellent reputation scores on other major platforms.
What the experts say
Experts in email deliverability acknowledge the difficulty in resolving false positive phishing detections, particularly with antivirus software that maintains its own proprietary blocklists and detection logic. They emphasize that while standard email authentication (like DMARC) is crucial for legitimate sending, it doesn't always prevent an antivirus from incorrectly flagging content. A common theme is the challenge of navigating tier 1 support, which may lack the authority or training to address complex false positive cases, often necessitating persistent escalation within the organization. This struggle is reminiscent of historical battles against overzealous anti-spam measures.
Key opinions
- Proprietary databases: Antivirus companies like Avast maintain their own detection databases, meaning direct communication with them is the only way to get a false positive resolved. These are distinct from public blacklists or blocklists. Using a blocklist checker may not reveal Avast-specific internal flags.
- Tier 1 support limitations: Many experts concur that tier 1 support for antivirus companies is often inadequate for complex false positive issues. They may be outsourced, undertrained, or lack the authority to fix the problem, making escalation necessary.
- Historical parallels: The challenges in resolving antivirus false positives are compared to the early days of anti-spam efforts, where initial support levels often had strong, sometimes incorrect, opinions about what constituted badness.
- Empathy for support: While frustrating, experts also express some empathy for tier 1 support personnel, acknowledging their limited power and the potential for abuse they receive from frustrated users.
Key considerations
- Thorough investigation: Before reporting, ensure the website linked in emails is secure (HTTPS) and has been scanned for any actual phishing content or malware, even if initial checks with other tools show nothing. A domain marked unsafe by Google Safe Browsing could cause similar issues.
- Escalation strategy: Be prepared to escalate the issue if initial attempts at resolution through standard support channels are unsuccessful. This might involve looking for higher-level contact information or leveraging existing business relationships.
- Documentation is vital: Provide all possible relevant data, including headers, screenshots, and details of your email and web infrastructure, to strengthen your case for a false positive.
- Consult community resources: Check community forums and online discussions for similar experiences and advice, as others may have found workarounds or direct contacts. These communities often share helpful lists of where to submit false-positive reports.
- Antivirus exceptions: For individual users, adding the legitimate site or email sender as an exception in Avast antivirus settings can temporarily resolve the blocking, but this is not a scalable solution for widespread deliverability issues.
Expert view
Deliverability expert from Email Geeks asks if there are links in the email, if they point to something asking for username/password, or if the website linked is actually secure. They also inquire if anything problematic is attached to the email, beyond what was obscured in the screenshot.
Expert view
Deliverability expert from Email Geeks states that if one is sure it's a false positive, the Avast website's false positive file form is the correct place to report it. They emphasize that Avast maintains its own database, so direct engagement is required.
What the documentation says
Official documentation and community resources provide the most direct guidance for resolving false positive phishing detections. They typically outline specific forms or email addresses for reporting, emphasizing the need for detailed information to aid in the investigation. These resources also sometimes acknowledge the prevalence of false positives and the potential for delays in resolution. The general recommendation is to follow official channels and provide comprehensive evidence to expedite the review process and get the legitimate content or domain de-listed from internal blocklists.
Key findings
- Official reporting forms: Antivirus vendors like Avast provide dedicated web forms for reporting false positives, which are considered the official and most direct channel for submission.
- Specific contact points: Beyond web forms, specific email addresses (e.g., customer.support@avast.com, support@business.avast.com) are often provided for direct communication regarding business-related false positives.
- Required information: Documentation typically requires users to submit detailed information, including the file or URL in question, screenshots of the warning, and relevant context to help the vendor analyze the potential false positive.
- Consolidated lists: Community-maintained lists (like some GitHub gists) compile reporting contacts for various antivirus vendors, making it easier to find the right channels for diverse false positive issues.
Key considerations
- Follow vendor guidelines: Adhere strictly to the antivirus vendor's specific instructions for reporting false positives, as deviations can lead to delays or ignored submissions. Also ensure your email setup avoids common reasons emails fail.
- Retesting: Before submitting a false positive report, re-scanning the file or URL is often recommended to ensure the issue persists and isn't a temporary anomaly.
- Whitelisting programs: Some antivirus companies offer whitelisting programs for legitimate software or domains. Exploring these programs can proactively reduce the likelihood of future false positives. This proactive step helps to boost email deliverability rates overall.
- Community support: While direct reporting is key, Avast's community forums can also be a source of information and peer support for similar issues, often providing a helpful link to the false positive reporting form directly.
Technical article
Avast Antivirus documentation directs users to a specific form for reporting false positives related to files. This form is the primary channel for submitting legitimate files that have been incorrectly flagged as malicious.
Technical article
Avast Community documentation indicates that the best way to get Avast to resolve false positives is to report them directly to the Avast team and then await their review and action.
Related resources
13 resources
![[urgent] avg and avast flagging site as phishing (again)](https://us1.discourse-cdn.com/bubble/original/3X/1/6/169e54edcb90c3e023f51bbb4704a48b67235799.png)
Related pages
Why do emails get a phishing warning in Gmail and how to prevent it?
How to prevent Gmail from marking emails as phishing due to linked login pages?
Why do emails get phishing warnings even with no links?
Why are my emails triggering Gmail phishing warnings and how can I fix it?
How email blocklists actually work: a simple guide
What happens when your domain is on an email blacklist?
A simple guide to DMARC, SPF, and DKIM
Why your emails fail: expert guide to improve email deliverability [2025]
Boost email deliverability rates: technical solutions from top performing senders
A practical guide to understanding your email domain reputation
