Skip to main content

​
Inbound attachment threat scan

Every inbound email attachment that arrives at a domain you point at Orbit passes through a byte-level threat scan — the same gate inbound MMS media passes — before it reaches your agents or your recipients. One action follows a part’s verdict: allow and archived to the media store, or quarantine and dropped before any byte is uploaded. The whole model is tenant-level policy: your account’s policy decides which verdicts reach your agents, and the metadata keys below are the audit record of every drop.

​
Verdict bands — clean, suspicious, malicious

The scan composite-scores a small set of independent, machine-readable signal classes and cuts the score into three bands. The bands are coarse by design — you see a verdict, not a wiring diagram. Signal classes (each matched class adds points to the score; the band is the cutoff the score crosses): Every quarantined message records the per-part breakdown as machine-readable finding codes so you can audit why a specific part was dropped.

​
The allow / quarantine action

Two actions follow from the band: A quarantine verdict drops the part before it is uploaded: the part never reaches the media bucket, never lands in an agent inbox, and serves no bytes to your recipients. A suspicious part still archives — your agent sees it, and the flag tells your team to look.

​
The metadata contract

The scan stamps onto each message row in one pass, so the audit trail shows both outcomes:
  • metadata.email_attachments — the archived allow parts, in the same { filename, url, content_type, size } shape the outbound send path writes, so the message detail view renders each entry with a re-freshed download URL.
  • metadata.email_attachments_quarantined — the quarantined parts, one entry per part: filename, content_type, size, score, the band, and the finding_codes of each matched signal. No raw bytes, no sender content.
A message whose inbound email declared attachments stays metadata-only in the inbound-parse webhook payload — the keys above are the archive/audit contract the forward cannot inline.

​
Worked JSON sample

​
Troubleshooting

My recipient says an attachment is missing. Check metadata.email_attachments_quarantined before treating the send as a delivery failure — a quarantined part’s entry names the part and the finding codes. If the key is absent, the part archived and the recipient-side issue is elsewhere (the media-store URL, or the view the recipient uses).

​
See also

Inbound email and SMS routing

The end-to-end inbound email guide this quarantine model plugs into.

Email attachments

Limits and MIME rules for sending.

Media file upload and presign lifecycle

The object-storage plane the archived media lands in.

Settings → Media

Work quarantined uploads under Settings → Media.