diff --git a/mail-server/rspamd.nix b/mail-server/rspamd.nix
index 55fe21a..47fe33b 100644
--- a/mail-server/rspamd.nix
+++ b/mail-server/rspamd.nix
@@ -27,19 +27,22 @@ in
   config = with cfg; lib.mkIf enable {
     services.rspamd = {
       enable = true;
-      extraConfig = ''
-        extended_spam_headers = yes;
-      '' + (lib.optionalString cfg.virusScanning ''
-        antivirus {
-          clamav {
-            action = "reject";
-            symbol = "CLAM_VIRUS";
-            type = "clamav";
-            log_clean = true;
-            servers = "/run/clamav/clamd.ctl";
-          }
-        }
-      '');
+      inherit debug;
+      locals = {
+          "milter_headers.conf" = { text = ''
+              extended_spam_headers = yes;
+          ''; };
+          "antivirus.conf" = lib.mkIf cfg.virusScanning { text = ''
+              clamav {
+                action = "reject";
+                symbol = "CLAM_VIRUS";
+                type = "clamav";
+                log_clean = true;
+                servers = "/run/clamav/clamd.ctl";
+                scan_mime_parts = false; # scan mail as a whole unit, not parts. seems to be needed to work at all
+              }
+          ''; };
+      };
 
       workers.rspamd_proxy = {
         type = "rspamd_proxy";
diff --git a/tests/clamav.nix b/tests/clamav.nix
index f53de4c..434b196 100644
--- a/tests/clamav.nix
+++ b/tests/clamav.nix
@@ -125,10 +125,15 @@ import <nixpkgs/nixos/tests/make-test.nix> {
           };
           "root/.msmtprc" = {
             text = ''
-              account        test2
+              defaults
+              tls            on
+              tls_certcheck  off
+
+              account        user2
               host           ${serverIP}
               port           587
               from           user@example2.com
+              auth           on
               user           user@example2.com
               password       user2
             '';
@@ -169,7 +174,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
             X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
             --Apple-Mail=_2689C63E-FD18-4E4D-8822-54797BDA9607--
           '';
-          "root/email2".text = ''
+          "root/safe-email".text = ''
             From: User <user@example2.com>
             To: User1 <user1@example.com>
             Cc:
@@ -187,13 +192,17 @@ import <nixpkgs/nixos/tests/make-test.nix> {
       };
     };
 
-  testScript =
+  testScript = { nodes, ... }:
       ''
       startAll;
 
       $server->waitForUnit("multi-user.target");
       $client->waitForUnit("multi-user.target");
 
+      # TODO put this blocking into the systemd units? I am not sure if rspamd already waits for the clamd socket.
+      $server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ \$? -eq 124 ]");
+      $server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/clamav/clamd.ctl < /dev/null; [ \$? -eq 124 ]");
+
       $client->execute("cp -p /etc/root/.* ~/");
       $client->succeed("mkdir -p ~/mail");
       $client->succeed("ls -la ~/ >&2");
@@ -206,7 +215,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
 
       # Verify that mail can be sent and received before testing virus scanner
       $client->execute("rm ~/mail/*");
-      $client->succeed("msmtp -a test2 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/email2 >&2");
+      $client->succeed("msmtp -a user2 user1\@example.com < /etc/root/safe-email >&2");
       # give the mail server some time to process the mail
       $server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
       $client->execute("rm ~/mail/*");
@@ -214,13 +223,12 @@ import <nixpkgs/nixos/tests/make-test.nix> {
       $client->succeed("fetchmail -v >&2");
       $client->execute("rm ~/mail/*");
 
-
       subtest "virus scan file", sub {
-        $server->fail("clamscan --follow-file-symlinks=2 -r /etc/root/ >&2");
+          $server->succeed("clamdscan \$(readlink -f /etc/root/eicar.com.txt) | grep \"Txt\\.Malware\\.Agent-1787597 FOUND\" >&2");
       };
 
-      subtest "virus scanner", sub {
-          $client->fail("msmtp -a test2 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/virus-email >&2");
+      subtest "virus scan email", sub {
+          $client->succeed("msmtp -a user2 user1\@example.com < /etc/root/virus-email 2>&1 | grep \"server message: 554 5\\.7\\.1 clamav: virus found: .*\\(Eicar\\|EICAR\\)\" >&2"); # for some reason this ID is nondetermistic...
           # give the mail server some time to process the mail
           $server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
       };
diff --git a/tests/extern.nix b/tests/extern.nix
index 4b5b91f..78a5266 100644
--- a/tests/extern.nix
+++ b/tests/extern.nix
@@ -275,13 +275,16 @@ import <nixpkgs/nixos/tests/make-test.nix> {
       };
     };
 
-  testScript =
+  testScript = { nodes, ... }:
       ''
       startAll;
 
       $server->waitForUnit("multi-user.target");
       $client->waitForUnit("multi-user.target");
 
+      # TODO put this blocking into the systemd units?
+      $server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ \$? -eq 124 ]");
+
       $client->execute("cp -p /etc/root/.* ~/");
       $client->succeed("mkdir -p ~/mail");
       $client->succeed("ls -la ~/ >&2");