The default action option which the Content filter will initiate upon receiving an email within which we have detected what we/the customer (via their content filter settings), have deemed as being "Forbidden attachments". Is to 'cut the attachment and inform the receiver'. Which means that we allow the original email to go through to the user, but without the attachment.

The attachment will be re-named for information purposes ' removed_by_contentcontrol' and the original email with attachment, will still remain in our quarantine ready for full delivery if required.

You can change this setting to "Store emails in quarantine" This feature will save emails with filtered out attachments in the quarantine and prevent them from being delivered to the recipients.