Technical Tip: Released email from personal quarantine received multiple times when using O365 as mail server

Description

This article describes how to avoid duplicate emails received on quarantine releases.

Web release: Quarantine message '08HA3Gaa014628-08HA3Gac014628' of account lab@lab.la was released via a web link from x.x.x.x.

Scope

FortiMail versions 6.0, 6.2 ,6.4 and 7.0

Solution

Check the header of received emails and if following is noticed in the header

X-MS-Exchange-Safelinks-Url-KeyVer: 1
X-MS-Exchange-ATPSafeLinks-Stat: 0

Then that means Office 365 has the ATP feature Safe Links enabled. This is known to generate multiple release requests which would generate duplicate emails.

The recommendation is to disable or create a rule in Office 365 to bypass the Safe Links scan for FortiMail.