In action profiles (see Configuring antispam action profiles, Configuring antivirus action profiles, and Configuring content action profiles), you can select an action:

• Deliver to alternate host

• Deliver to original host

• System quarantine

• Personal quarantine

• Disclaimer insertion

• Subject tag location

• Replacement message location

For delivery and quarantine actions, you can select which form of the email to use:

• Modified copy — Modify the email according to the action.

• Unmodified copy — Original email header and body.

  If the email is in its original form, the recipient in the SMTP envelope (RCPT TO:) still might be rewritten by the action.

For example, when the HTML content is converted to text, if you choose to deliver the unmodified copy, then the HTML version will be delivered; if you choose to deliver the modified copy, then the plain text version will be delivered.

For Disclaimer insertion, select where to insert the disclaimer:

• Selected messages — Only new email in threads. Thread replies do not receive a disclaimer. This avoids repeatedly inserting disclaimers that recipients have already seen.

  Threads are detected when the same domain is in both the Message-ID: and In-Reply-To:/References: message headers. In RFC 2822, those message headers are optional. If an email client doesn't support them, then this setting has no effect.

• All messages — Both new and reply email in threads.

For Subject tag location, you can choose to insert the tag at the start or end of the subject line.

If the action in one profile is one of the final actions, such as System quarantine, while the action in another profile is to deliver to the original host or alternate host, you can enable this option to overwrite the final action.

For spam email that is sent to personal quarantine, you have the option to continue or stop further scanning the email attachments.

Specify the following:

• Maximum level to decompress archive file: Specify how many levels to decompress the archived files for antivirus and content scan. Valid range is 1 to 36. Default value is 12.

• Maximum archive file size to decompress (MB): Specify the maximum file size to scan after the archived files are decompressed. This applies to every single file after decompression. Bigger files will not be scanned. Default value is 10MB.

• Maximum compression ratio for archive bomb: Specify the maximum compression ratio for FortiMail to decompress. Valid range is 1 to 1000. Default value is 200.

Select either:

• Action profile: Use the action specified in the antispam profile.
• Action profile with none: If the policy option in the sender's DMARC record is p=none, use that action. Else use the action in the antispam profile.
• DMARC record policy: Use the actions specified in the policy option of the sender's DMARC record.

The default setting is Action profile with none.

This system-wide setting can be overridden by a per-domain setting. For details, see the FortiMail CLI Reference.

Email impersonation is one of the email spoofing attacks. It forges the email header to deceive the recipient because the message appears to be from a different source than the actual address.

To fight against email impersonation, you can map display names with email addresses and check email for the mapping.

You can choose whether the impersonation analysis uses manual mapping entries or dynamic entries. You can also use both types of entries.

• Manual: Use the entries you manually entered under Profile > AntiSpam > Impersonation.
• Dynamic: Use the entries automatically learned by the FortiMail mail statistics service. To enable this service, enable mailstat-service under config system global.

The default setting is Manual.