What does an email gateway with content control check, and what can it do with a suspicious email?

Question

Accepted Answer

Besides checking that SMTP, POP3 and IMAP are used as specified, it filters metadata and content for bad intent: sender and recipient against white- and blacklists, spam and malware detection, content rules (size, format, executable content, keywords), an extra virus scanner, and statistical or AI-based anomaly analysis. Depending on the rule, a suspicious email is blocked, cleaned, moved to quarantine or deleted.

* Each email is checked against many filters, then delivered or handled in one of four ways. *
The filter patterns, especially for the expensive analyses, are usually kept current through a subscription from the vendor. The four outcomes differ in how much is lost: blocking refuses the message, cleaning removes the dangerous part (an attachment, a link) and delivers the rest, quarantine parks it for an administrator or user to review, and deleting removes it for good.
Go deeper:

Email filtering — Wikipedia — how mail filters sort, quarantine and reject messages.
 Anti-spam techniques — Wikipedia — blacklists, content analysis and the other filter methods.
 MITRE ATT&CK T1566 — Phishing — the attacks an email gateway exists to catch.