Will my email be passed?

[Blason_R]

I have MX set on cloud and have internal mail server; My question here is -

In background mode - Email will be passed and attachment will be sent for Emulation while
In Hold mode - Email will be cached and attachment will be sent for emulation. What if the attachment is malicious will the email be still passed without attachment or discarded which was cached?

[Kyle_Danielson]

Hold-mode has the ability to block emails before delivery if we're able to quickly determine that it's malicious, however SMTP traffic generally has a much lower timeout than HTTP traffic.

Because of this, if you're looking for reliable prevention on emails going through the firewall, you can configure the GW as a MTA and use it as a SMTP next hop. In this configuration it's able to hold the email for the required amount of time for analysis and then decide whether or not to send it out.

Mail Transfer Agent (MTA) - FAQ