spamfilter bword

Use this command to add or edit and configure options for the email filter banned word list.

The FortiGate email filters are applied in the following order:

For SMTP

1. IP address BWL check - Last hop IP
2. DNSBL & ORDBL check, IP address FortiGuard check, HELO DNS lookup
3. E-mail address BWL check
4. MIME headers check
5. IP address BWL check (for IPs extracted from “Received” headers)
6. Return e-mail DNS check, FortiGuard Antispam check (for IPs extracted from “Received” headers, and URLs in email content)
7. Banned word check

For POP3 and IMAP

1. E-mail address BWL check
2. MIME headers check, IP BWL check
3. Return e-mail DNS check, FortiGuard Antispam check, DNSBL & ORDBL check
4. Banned word check

For SMTP, POP3, and IMAP

Control spam by blocking email messages containing specific words or patterns. If enabled, the FortiGate unit searches for words or patterns in email messages. If matches are found, values assigned to the words are totaled. If a user-defined threshold value is exceeded, the message is marked as spam. If no match is found, the email message is passed along to the next filter.

Use Perl regular expressions or wildcards to add banned word patterns to the list. Add one or more banned words to sort email containing those words in the email subject, body, or both. Words can be marked as spam or clear. Banned words can be one word or a phrase up to 127 characters long.

If a single word is entered, the FortiGate unit blocks all email that contain that word. If a phrase is entered, the FortiGate unit blocks all email containing the exact phrase. To block any word in a phrase, use Perl regular expressions.

Perl regular expression patterns are case sensitive for email filter banned words. To make a word or phrase case insensitive, use the regular expression /i. For example, /bad language/i blocks all instances of bad language regardless of case. Wildcard patterns are not case sensitive.

config spamfilter bword
    edit {id}
    # Configure AntiSpam banned word list.
        set id {integer}   ID. range[0-4294967295]
        set name {string}   Name of table. size[35]
        set comment {string}   Optional comments. size[255]
        config entries
            edit {id}
            # Spam filter banned word.
                set status {enable | disable}   Enable/disable status.
                set id {integer}   Banned word entry ID. range[0-4294967295]
                set pattern {string}   Pattern for the banned word. size[127]
                set pattern-type {wildcard | regexp}   Wildcard pattern or regular expression.
                        wildcard  Wildcard pattern.
                        regexp    Perl regular expression.
                set action {spam | clear}   Mark spam or good.
                        spam   Mark as spam email.
                        clear  Mark as good email.
                set where {subject | body | all}   Component of the email to be scanned.
                        subject  Banned word in email subject.
                        body     Banned word in email body.
                        all      Banned word in both subject and body.
                set language {option}   Language for the banned word.
                        western   Western.
                        simch     Simplified Chinese.
                        trach     Traditional Chinese.
                        japanese  Japanese.
                        korean    Korean.
                        french    French.
                        thai      Thai.
                        spanish   Spanish.
                set score {integer}   Score value. range[1-99999]
            next
    next
end

Additional information

The following section is for those options that require additional explanation.

action

• Enter clear to allow the email.
• Enter spam to apply the spam action.

language

Enter the language character set used for the banned word or phrase.

pattern

Enter the banned word or phrase pattern using regular expressions or wildcards.

pattern-type

Enter the pattern type for the banned word (pattern). Choose from regular expressions or wildcard.

score

A numerical weighting applied to the banned word. The score values of all the matching words appearing in an email message are added, and if the total is greater than the spamwordthreshold value, the message is processed according to the spam action setting. The score for a banned word is counted once even if the word appears multiple times in an email message.

where

Enter where in the email to search for the banned word or phrase.