profile impersonation
Email impersonation is one of the email spoofing attacks. It forges the email header to deceive the recipient because the message appears to be from a different source than the actual address.
To fight against email impersonation, you can map high valued target display names with correct email addresses and FortiMail can check for the mapping. For example, an external spammer wants to impersonate the CEO of your company(ceo@company.com). The spammer will put "CEO ABC <ceo@external.com>" in the Email header From, and send such email to a user(victim@company.com). If FortiMail has been configured with a manual entry "CEO ABC"/"ceo@company.com" in an impersonation analysis profile to indicate the correct display name/email pair, or it has learned display name/email pair through the dynamic process, then such email will be detected by impersonation analysis, because the spammer uses an external email address and an internal user's display name.
You can also add empt entries to force the FortiMail to skip impersonation analysis.
There are two ways to do the mapping:
- Manual: you manually enter mapping entries and create impersonation analysis profiles as described below.
- Dynamic: FortiMail Mail Statistics Service can automatically learn the mapping.
Syntax
config impersonation
edit <name>
config entry
edit <entry>
set display-name
set email-address
config exempt
edit <entry>
set display-name
set email-address
end
|
Variable |
Description |
Default |
|
Enter the profile name. |
|
|
|
Enter the profile entry |
|
|
|
Enter the display name to be mapped to the email address. You can use the wildcard or regular expression. |
|
|
|
Enter the display name pattern |
|
|
|
Enter the email address to be mapped to the display name. The email address can be from protected/internal domains or unprotected/external domains. |
|