Technical Tip: Understanding Reject, Discard, and Quarantine Actions in FortiMail
Description
This article describes the differences between the Reject, Discard, and Quarantine actions in FortiMail and explains when each action is applied during email processing.
Scope
FortiMail.
Solution
FortiMail provides several actions that can be configured in session, content, antispam and antivirus profiles when handling email messages.
Understanding the behavior of each action helps administrators select the appropriate response for different types of threats.
Reject:
When Reject is configured, FortiMail refuses the email during the SMTP transaction by returning an SMTP error code to the sending mail server.
Characteristics:
The sender is immediately informed that delivery failed.
The message is not accepted by FortiMail.
The message is not stored in the mail queue.
No local copy of the email is retained unless logging is enabled.
Typical use cases include:
Invalid recipients.
SMTP protocol violations.
Known malicious senders.
Blocked IP addresses.
Messages that should never be accepted.
Discard:
When Discard is configured, FortiMail accepts the message during the SMTP session but silently deletes it after processing.
Characteristics:
The sending mail server believes the message was delivered successfully.
No Non-Delivery Report (NDR) is generated.
The recipient never receives the message.
The message is permanently removed.
Typical use cases include:
Spam campaigns.
Malware.
Known phishing emails.
Messages that should be removed without notifying the sender.
Administrators should use this action carefully, as legitimate messages cannot be recovered once discarded.
Quarantine:
When Quarantine is configured, FortiMail accepts the message and stores it in the quarantine database instead of delivering it to the recipient.
Characteristics:
The email is retained for review.
Administrators can inspect the message.
Depending on the configuration, end users may also be able to review or release quarantined messages.
The message can be released if it is determined to be legitimate.
Typical use cases include:
Suspected spam.
Suspicious attachments.
Potential phishing emails.
Messages requiring administrator review.
Quarantine provides a balance between blocking unwanted email and allowing recovery of false positives.