FortiMail let spam mail through

Hi Unknown

The action "Default" is the one you set in the "Default action" field at the top of the AntiSpam profile view. In your case it is UserQuarantime and it is fine, I think it is the recommended once, since you will be able to find any false positive in the FML's quarantine folders.

Now if you have some false negatives (spam mails allowed by FML) then you need some tuning in your AntiSpam profile or Session profile or other, depending on the characteristics of the received spam mails, I mean you may need to analyze them (to see what characterizes them as spam) and compare with your profiles to see why they have been allowed, then you can tune your profiles according to your findings so FML will block them next time.