policy access-control receive
Use this command to configure access control rules that apply to SMTP sessions being received by the FortiMail unit ( initiated by SMTP clients).
Access control rules, sometimes also called the access control list or ACL, specify whether the FortiMail unit will process and relay/proxy, reject, or discard email messages in SMTP sessions.
When an SMTP client tries to send email through the FortiMail unit, the FortiMail unit compares each access control rule to the commands used by the SMTP client during the SMTP session, such as:
- sender email address in the SMTP envelope (
MAIL FROM:) - recipient email address in the SMTP envelope (
RCPT TO:) - authentication (
AUTH) - session encryption (
STARTTLS).
Rules are evaluated for a match in sequential order, from top to bottom of the list. If all attributes of a rule match, then the FortiMail unit applies the action in the rule or TLS profile, and stops match evaluation. Remaining access control rules, if any, are not applied.
Only one access control rule is applied to an SMTP session.
|
If no access control rules exist, or none match, then the action varies by whether the SMTP client authenticated: The default action varies by whether or not the recipient email address in the SMTP envelope (
See also domain. |
Rejecting unauthenticated SMTP clients that send email to unprotected domains prevents your email service from becoming an open relay. Open relays are abused by spammers, and therefore DNSBLs block them, so this FortiMail behavior helps to protect the reputation of your email server. Senders can deliver email incoming to your protected domains, but cannot deliver email outgoing to unprotected domains
If you want to allow your email users or email servers to send email to unprotected domains, then you must configure at least one access control rule. You may need to configure more access control rules if, for example, you want to discard or reject email from:
- specified email addresses, such as ones that no longer exist in your protected domain
- specified SMTP clients, such as a spammer that is not yet known to public blocklists
Like IP-based policies, access control rules can reject connections based on IP address.
Unlike IP-based policies, however, access control rules cannot affect email in ways that occur after the session’s DATA command, such as by applying antispam profiles. Access control rules also cannot be overruled by recipient-based policies, and cannot match connections based on the SMTP server (which is always the FortiMail unit itself, unless the FortiMail unit is operating in transparent mode). For more information on IP-based policies, or the sequence in which access control rules are used relative to other antispam methods, see the FortiMail Administration Guide.
Syntax
config policy access-control receive
edit <rule_id>
set action {discard | receive | reject | relay | safe | safe-relay}
set authenticated {any | authenticated | not-authenticated}
[set comment <description_str>]
set recipient-pattern <pattern_str>
set recipient-pattern-type {default | group | regexp}
set recipient-pattern-regexp {yes | no}
set recipient-pattern-group <group_name>
set reverse-dns-pattern <pattern_str>
set reverse-dns-pattern-regexp {yes | no}
set sender-ip-group <ip_group_name>
set sender-ip-mask <ip_netmask_str>
set sender-ip-type {ip-group | ip-mask}
set sender-pattern <pattern_str>
set sender-pattern-type {default | group | regexp}
set sender-pattern-group <group_name>
set sender-pattern-regexp {yes | no}
[set tls-profile <profile_str>]
end
|
Variable |
Description |
Default |
|
Enter the number identifying the rule. |
|
|
|
action {discard | receive | reject | relay | safe | safe-relay} |
Enter the delivery action the FortiMail unit will perform for SMTP sessions matching this access control rule:
|
reject |
|
Enter a value to indicate whether this rule applies only to messages delivered by clients that have authenticated with the FortiMail unit.
|
any |
|
|
Enter a descriptive comment. The comment will appears as a mouse-over tooltip in the ID column of the rule list. |
|
|
|
Enter a pattern that defines recipient email addresses which match this rule, surrounded in slashes and single quotes (such as |
* |
|
|
Enter the pattern type.
|
default |
|
|
Enter This option is available only when recipient-pattern-type {default | group | regexp} is |
|
|
|
Enter the group name to specify the recipient pattern. This option is available only when recipient-pattern-type {default | group | regexp} is |
|
|
|
Enter a pattern to compare to the result of a reverse DNS look-up of the source IP address of the SMTP client attempting to send the email message. Because domain names in the SMTP session are self-reported by the connecting SMTP server and easy to fake, the FortiMail unit does not trust the domain name that an SMTP server reports. Instead, the FortiMail does a DNS lookup using the SMTP server’s IP address. The resulting domain name is compared to the reverse DNS pattern for a match. If the reverse DNS query fails, the access control rule match will also fail. If no other access control rule matches, the connection will be rejected(SMTP reply code Wildcard characters allow you to enter partial patterns that can match multiple reverse DNS lookup results. An asterisk ( For example, the recipient pattern Note: Reverse DNS queries for access control rules require that the domain name be a valid top level domain (TLD). For example, “.lab" is not a valid top level domain name, and thus the FortiMail unit cannot successfully perform a reverse DNS query for it. |
* |
|
|
Enter |
no |
|
|
Enter the IP group of the SMTP client attempting to send the email message. This option only appears if you enter ip-group in sender-ip-type {ip-group | ip-mask}. |
|
|
|
Enter the source IP address and netmask of the SMTP client attempting to send the email message. Use the netmask, the portion after the slash ( For example, you can enter Similarly, if you enter To match any address, enter |
0.0.0.0 0.0.0.0 |
|
|
Select the method of the SMTP client attempting to send the email message. Also configure sender-ip-mask <ip_netmask_str> and sender-ip-group <ip_group_name>. |
ip-mask |
|
|
Enter a pattern that defines sender email addresses which match this rule, surrounded in slashes and single quotes (such as This option is only available if you enter |
* |
|
|
Enter the pattern type.
|
default |
|
|
Enter the group name to match any email address in the group. |
|
|
|
Enter This option is only available if you enter |
no |
|
|
Enter |
enable |
|
|
Enter a TLS profile to allow or reject the connection based on whether the communication session attributes match the settings in the TLS profile.
For more information on TLS profiles, see the FortiMail Administration Guide. |
|
Related topics
policy access-control delivery