Skip to main content
S
Serzhan
New Member
May 15, 2026
Question

Fortimail 8.0 Release Rescan

  • May 15, 2026
  • 2 replies
  • 65 views

Hello,

I have a question regarding the Quarantine Release Re-scan feature in FortiMail 8.0.0.

During testing, I noticed that the re-scan mechanism appears to work only for attachments/content scans, while URLs inside the email are not re-checked during message release from quarantine.

Test scenario:

  • A message containing a phishing URL was quarantined.

  • Quarantine Release Re-scan was enabled for AntiSpam, AntiVirus, FortiSandbox, Content.

  • After clicking Release, the email was delivered successfully.

  • No new URL reputation lookup or antispam URL scan events appeared in the logs.

  • It seems that the phishing URL was not re-evaluated during release.

Could you please clarify whether Quarantine Release Re-scan is intended to work only for:

  • attachments,

  • content inspection,

  • antivirus

and not for:

  • URL reputation checks,

  • FortiGuard URL filtering,

  • final URL inspection,

Thank you.

2 replies

Anthony_E
Staff
Anthony_E
Staff
May 15, 2026

Hello,

 

Did you have a look at this document?:

https://docs.fortinet.com/document/fortimail/8.0.0/administration-guide/401463/configuring-the-quarantines-and-personal-quarantine-reports

 

Anthony

Best Regards
S
SerzhanAuthor
New Member
May 15, 2026

Yes, I reviewed the documentation. The documentation states that re-scan is not performed when releasing emails from the Virus quarantine folder. However, in our case, we are releasing emails from the Bulk quarantine folder.

We also noticed that if the email contains an attachment with a phishing URL, the re-scan process works correctly and the email is quarantined again. But if the email does not contain any attachments and the phishing content is delivered only as a URL embedded directly in the email body, the message is released and delivered to the user without being quarantined again.

Maybe I misunderstood how this feature is supposed to work. Could you please clarify whether this behavior is expected?

Terms & ConditionsAccessibility statement