SPF records using macros are not handled properly.

Outbound email from FortiMail Cloud occasionally fails DKIM check.

Return code from DNSBL events of spamhaus.org is not handled properly.

Disclaimer Insertion action is logged but no disclaimer is inserted in the email.

OpenSSL encrypted files (.enc files) are not detected by the correct file type.

Email cannot be released from user quarantine or system quarantine when sandbox re-scan is enabled.

Content Monitor does not detect regular expressions in CSV attachments.

Some .docx files may not be processed properly when antivirus is enabled.

In some cases, the content filter fails to allow text/plain attachments.

Authentication-Results header placement doesn't follow RFC7601.

In some cases, a single email may be sent to personal quarantine numerous times.

The initial SMTP greeting message 220 is sent after about four seconds, instead of instantly.

DSN is still sent even though DSN notification is disabled.

Error message when sending email in batches with more 25 recipients.

In some cases, AWS VM license might be disabled as duplicate.

When some LDAP profiles have network connection issues, all LDAP profiles may not work properly.

If the mail data is scheduled to be backed up with one copy only, the new backup does not overwrite the old ones.

When the full config file is backed up via TFTP, the file cannot be decompressed correctly.

PDF attachment scan may cause high CPU usage.

After upgrading from 6.2.4 to 6.4.5 release, the config-only HA primary unit is reset to standalone.

Upgrade issue from 6.0.x to 6.2.x releases.

After upgrading to 6.4.5 release, users cannot access the quarantine via webmail.

In active-passive HA mode, when disabling admin/web access to one port, access to another port may also be disabled.

Incorrect Japanese translation in custom messages.

When Microsoft 365 has a large number of accounts, FortiMail's subscription process is slow.

SMTP server down in HA mode.

SMTP traffic cannot pass through the WCCP tunnel between FortiMail and FortiGate.

In some cases, RADIUS authentication with 2FA may not work properly.

Changing to an LDAP password not meeting the LDAP server's password policy via webmail returns a wrong message.

In server mode config-only HA, multiple calendar event reminders are sent to users.

No system event log is created for power supply issues.

SNMP trap and query options are missing from the GUI when adding SNMP communities and users.

Webmail access cannot be completely disabled.

CWE-20: Improper Input Validation

CWE-287: Improper Authentication

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')