Basic mode AntiSpam
Basic mode
The basic mode of the web-based manager provides easy navigation using a set of menu options that is more simple than the advanced mode. Less frequently used options are hidden, and some configurations are simplified by providing you with pre-defined configuration sets.
When you log in, the web-based manager initially appears in basic mode if that preference has been configured for your administrator account. Otherwise, it starts in advanced mode. For more information, see
“Configuring administrator accounts” on page 147
.
To manually switch from the advanced mode to the basic mode of the web-based manager, click Basic Mode >>.
This topic includes areas of the menu that are unique to basic mode:
•
AntiSpam
Note: This topic does not describe areas of basic mode that also appear in the advanced mode of the web-based manager. For menu options that appear in both the advanced
mode and basic mode, see the advanced mode chapters, beginning with “Advanced mode” on page 49 .
AntiSpam
After you have integrated the FortiMail unit into your network by configuring the network interfaces and protected domains, you can configure the antispam and antivirus features of the FortiMail unit to protect your SMTP servers and email users. The AntiSpam submenu of the Settings menu enables you to customize these features.
Antispam and antivirus settings can be configured separately for incoming and outgoing
email messages. For definitions of incoming and outgoing, see “Incoming vs. outgoing email” on page 42 .
Note: The Antispam menu of the basic mode of the web-based manager presents simplified controls for typical antispam and antivirus configurations. If you need to achieve a more sophisticated configuration, additional settings are available in profiles and recipientbased and IP-based policies in the advanced mode of the web-based manager. For more
information, see “Profile” on page 285 and
“Policy” on page 259
.
The AntiSpam submenu includes:
•
Incoming
: Where you can select from predefined sets of antispam and antivirus actions for incoming email, and configure the connection with the protected email server.
•
Incoming Action : Where you can configure antispam and antivirus actions for incoming
email, such as tagging, quarantining, or discarding.
•
Outgoing
: Where you can select from predefined sets of antispam and antivirus actions for outgoing email, and configure access control rules for SMTP clients that are allowed to send outgoing email.
•
Outgoing Action
: Where you can configure antispam and antivirus actions for outgoing email, such as tagging, quarantining, or discarding.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
41
AntiSpam Basic mode
Incoming vs. outgoing email
Available FortiMail features and their behavior vary by the direction of each email.
• Incoming email messages consist of messages sent to the SMTP servers that are protected domains of the FortiMail unit. For example, if the FortiMail unit is configured to protect the SMTP server whose domain name is example.com, the FortiMail unit treats all email messages sent to example.com as incoming email. For information about configuring protected domains, see
“Configuring protected domains” on page 211 .
• Outgoing email messages consist of messages sent to recipients on domains that the
FortiMail unit has not been configured to protect. For example, if the FortiMail unit is
not configured to protect the domain example.com, all email messages sent to recipients at example.com will be treated as outgoing email, regardless of their origin.
Incoming
The Incoming tab displays the antispam and antivirus settings for each protected domain, and enables you to customize these default settings.
To view the incoming antispam and antivirus settings, go to Settings > AntiSpam >
Incoming.
Figure 2: Viewing the list of antivirus and antispam settings for email incoming to each protected domain
42
Domain
AntiSpam
AntiVirus
The name of the protected domain. For information on configuring protected domains, see
“Configuring protected domains” on page 211 .
The current antispam settings level, such as Medium.
This setting will be Advanced if:
• you have created the protected domain, but have not yet selected an antispam level, and the FortiMail unit is currently using default antispam settings, or
• you have used the advanced mode of the web-based manager to configure the FortiMail unit to use profiles other than those such as such as
antispam_basic_predefined_high, which correspond to the antispam levels in the basic mode of the web-based manager
The current antivirus setting, such as Enabled.
This setting will be Advanced if:
• you have created the protected domain, but have not yet selected to enable or disable antivirus processing, and the FortiMail unit is currently using default antivirus settings, or
• you have used the advanced mode of the web-based manager to configure the FortiMail unit to use profiles other than those such as such as
antivirus_basic_predefined_enable, which correspond to the antivirus setting in the basic mode of the web-based manager
To edit incoming antispam and antivirus settings
1 Go to Settings > AntiSpam > Incoming.
2 Click the row corresponding to the protected domain whose antispam and antivirus settings you want to modify, then click Edit.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Basic mode AntiSpam
3 Configure the following:
Figure 3: Editing the antispam and antivirus settings for email incoming to a protected domain
Domain
AntiSpam Level
The entire FortiMail unit (System) or name of a protected domain.
For more information, see “About administrator account permissions & domains” on page 144 .
Select one of the following:
• Off: No antispam scanning.
• Low: Good spam detection rate.
• Medium: Better spam detection rate with a small impact on system performance.
• High: Best spam detection rate with an additional impact on system performance.
Select Enabled to perform antivirus scanning. AntiVirus level
4 Click OK.
Incoming Action
The Incoming Action tab enables you to select which action the FortiMail unit will take against spam and virus-infected email if it is incoming to a protected domain.
Note: For more information on determining directionality, see “Incoming vs. outgoing
recipient-based policies” on page 259
and “Incoming vs. outgoing SMTP connections” on page 231
.
To configure the actions
1 Go to Settings > AntiSpam > Incoming Action.
2 Configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
43
AntiSpam Basic mode
Figure 4: Editing the actions on spam and viruses incoming to a protected domain
44
AntiSpam Actions
Tag email’s subject line
Insert new header
Reject
Discard
Enable and enter the text that will appear in the subject line of the email, such as “[spam]”, in the With value field. The FortiMail unit will prepend this text to the subject line of spam before forwarding it to the recipient.
Many email clients can sort incoming email messages into separate mailboxes, including a spam mailbox, based on text appearing in various parts of email messages, including the subject line. For details, see the documentation for your email client.
Enable and enter the message header key in the field, and the values in the With value field. The FortiMail unit will add this text to the message header of the email before forwarding it to the recipient.
Many email clients can sort incoming email messages into separate mailboxes, including a spam mailbox, based on text appearing in various parts of email messages, including the message header. For details, see the documentation for your email client.
Message header lines are composed of two parts: a key and a value, which are separated by a colon. For example, you might enter:
X-Custom-Header: Detected as spam by profile 22.
If you enter a header line that does not include a colon, the
FortiMail unit will automatically append a colon, causing the entire text that you enter to be the key.
Note: Do not enter spaces in the key portion of the header line, as
these are forbidden by RFC 2822 .
Enable to reject the email and reply to the SMTP client with SMTP reply code 550.
Enable to accept the email, but then delete it instead of delivering the email, without notifying the SMTP client.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Basic mode AntiSpam
Quarantine Enable to redirect spam to the per-recipient quarantine. For more information, see
“Managing the personal quarantines” on page 63 . Also configure:
• Delete messages after n days: Enter the number of days you want to keep the quarantined email. Enter a small enough value that will prevent the size of the quarantine from exceeding the available disk space. If you enter 0 to prevent automatic deletion of quarantined files, you must periodically manually remove old files.
AntiVirus Actions
Replace virus body
Reject
Discard
3 Click Apply.
Indicates that the FortiMail unit will replace infected attachments with a replacement message. You can customize replacement
messages. For more information, see “Customizing replacement messages & quarantine report contents” on page 206
.
This option cannot be disabled, but does not apply if you also enable Reject or Discard.
Enable to reject infected email and reply to the SMTP client with
SMTP reply code 550.
Enable to accept infected email, but then delete it instead of delivering the email, without notifying the SMTP client.
Outgoing
After you have created a protected domain, the FortiMail unit will apply default outgoing antispam and antivirus settings to the protected domain. The Outgoing tab enables you to customize these default settings.
To view the outgoing antispam and antivirus settings, go to Settings > AntiSpam >
Outgoing.
Figure 5: Editing the antispam and antivirus settings for email outgoing to an unprotected domain
AntiSpam level
AntiVirus level
Access control
Select one of the following:
• Off: No antispam scanning.
• Low: Good spam detection rate.
• Medium: Better spam detection rate with a small impact on system performance.
• High: Best spam detection rate with an additional impact on system performance.
Enable to perform antivirus scanning.
Click to configure rules to allow specific SMTP clients to send email from your protected domains.
Proper access control rules prevent your FortiMail unit from being an open relay. Open relays are often used by spammers, and therefore are often blacklisted by other mail servers.
Access control rules allow, discard, reject, or relay email based on the sender, recipient, IP address, or a reverse DNS lookup of the domain name of the
connecting SMTP server. For details, see “Configuring access control rules” on page 262
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
45
AntiSpam Basic mode
Outgoing Action
The Outgoing Action tab enables you to select which action the FortiMail unit will take against spam and virus-infected email if it is outgoing to a mail domain that is not protected.
Note: For more information on determining directionality, see “Incoming vs. outgoing recipient-based policies” on page 259
and “Incoming vs. outgoing SMTP connections” on page 231
.
To configure the actions
1 Go to Settings > AntiSpam > Outgoing Action.
2 Configure the following:
Figure 6: Editing the actions on spam and viruses outgoing to an unprotected domain
AntiSpam Actions
Tag email’s subject line
Enable and enter the text that will appear in the subject line of the email, such as “[spam]”, in the With value field. The FortiMail unit will prepend this text to the subject line of spam before forwarding it to the recipient.
Many email clients can sort incoming email messages into separate mailboxes, including a spam mailbox, based on text appearing in various parts of email messages, including the subject line. For details, see the documentation for your email client.
46
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Basic mode AntiSpam
Insert new header Enable and enter the message header key in the field, and the values in the With value field. The FortiMail unit will add this text to the message header of the email before forwarding it to the recipient.
Many email clients can sort incoming email messages into separate mailboxes, including a spam mailbox, based on text appearing in various parts of email messages, including the message header. For details, see the documentation for your email client.
Message header lines are composed of two parts: a key and a value, which are separated by a colon. For example, you might enter:
X-Custom-Header: Detected as spam by profile 22.
If you enter a header line that does not include a colon, the
FortiMail unit will automatically append a colon, causing the entire text that you enter to be the key.
Note: Do not enter spaces in the key portion of the header line, as these are forbidden by RFC 2822 .
Reject
Discard
Enable to reject the email and reply to the SMTP client with SMTP reply code 550.
Enable to accept the email, but then delete it instead of delivering the email, without notifying the SMTP client.
AntiVirus Action s
Replace virus body
Reject
Discard
Indicates that the FortiMail unit will replace infected attachments with a replacement message. You can customize replacement messages. For more information, see
“Customizing replacement messages & quarantine report contents” on page 206 .
This option cannot be disabled, but does not apply if you also enable Reject or Discard.
Enable to reject infected email and reply to the SMTP client with
SMTP reply code 550.
Enable to accept infected email, but then delete it instead of delivering the email, without notifying the SMTP client.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
47
AntiSpam Basic mode
48
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
