Accept; Defer Disposition

[Storyteller]

What does it mean in log?

Regards,

Graziano.

[Bromont_FTNT]

Deferred because of Outbreak protection or for Fortisandbox inspection.

[Storyteller]

Is there the possibility that I receive this email with some delay in opposite to a simple "accepted" email?

Regards,

Graziano.

[ede_pfau]

Yes, definitively. Defered mails are delivered with some delay, like minutes, to be able to scan them. Mostly I see this with FortiSandbox which can take up to 30 minutes (the default hard limit). Depending on the number of URLs and the size and type of attachment a FSA scan takes 1-5 minutes.

[emnoc]

FWIW: Greylist can also creat Deferred email delivery or path interruptions between the sender-receiver and so on

It's not a bad message btw.

Ken

[Dirty_Wizard_FTNT]

For greylisting you should see delay rather than defer for the disposition.

[emnoc]

For greylisting you should see delay rather than defer for the disposition

Will it needs to be taken in context of the sending MTA.

A greylisting ESA is going to delay the sender but at the same time the sender will have mail_queue as "message deferred". This is not a hard bounce or failure

Depending on the receiver and greylisting mechanism employeed ( ironport , postfixgrey , barracuda, etc..... ) you might get a nice  4XX messages or nothing at all.

Bottom line greylisting  can cause a sender to have deferrals,  same as any other AS mechanism  like throttling.

[Dirty_Wizard_FTNT]

You are right. I was only referring to what can be displayed in FortiMail logs as a disposition.

Cheers

[smaqueda]

I am still a bit confuse with Defer Disposition 

not sure exactly how it works, any input will be greatly appreciated. 

if you whitelist an email it would skip defer disposition?

Thanks