Access receiving rule

[Muhammad_Farhan]

What i understand from the training video of Fortimail, it says if the sender is external and recipient is internal then Fortimail will allow the session by default, but for outbound email we need to create a "Access receive rule". 

But we need to protect our internal domains so why the default behavior is like that. 

[Dirty_Wizard_FTNT]

The inbound email is allowed to relay by default. This does not mean it bypasses antispam or any other checks.

Unauthenticated outgoing email is rejected by default otherwise the FortiMail would be an open relay out of the box.