When applying recipient-based policies, an email message with multiple recipients is treated as if it were multiple email messages, each with a single recipient. This allows a fine degree of control for each recipient, but also means that separate recipient-based policies may block the email for some recipients but allow it for others.

Exceptions include use of an antivirus profile. In this case, the FortiMail unit will treat an email with multiple recipients as a single email. Starting with the first recipient email address, the FortiMail unit will look for a matching recipient-based policy. If none is found, the FortiMail unit will evaluate each subsequent recipient email address for a matching policy. The FortiMail unit will apply only the first matching policy; it will not evaluate subsequent recipients for a matching policy. If no matching recipient-based policy is found, the FortiMail unit will apply the antivirus profile from the IP-based policy, if any.

If no recipient-based or IP-based policy matches, no profiles is applied.