Antispam tuning

• If the spam catch rate is low, see Troubleshoot antispam issues for fine tuning instructions.

• Use safe lists and block lists with caution. They can increase incorrect results.

  For example, a system-level safe list entry for *.edu email addresses allows email from all .edu top level domains. Sender email addresses in the SMTP envelope (MAIL FROM:) and message header (From:) can be fake, too. The result is that all spam from any .edu email address — real or fake — would bypass antispam scans.

  Better approaches are to either use client IP addresses (which are harder to fake) in access control policies or to use DKIM or SPF sender authentication (which is stronger and widely supported).

  Do not safelist protected domain names. Sender email addresses can be faked, so they may not really belong to the protected domain. This could allow spammers to bypass antispam scans.

• To prevent directory harvest attacks (DHA), use a combination of recipient verification and sender reputation.

DHA is a common method used by spammers. It utilizes recipient verification in an attempt to determine an email server’s valid email addresses so that they can be added to a spam database.

If Recipient Address Verification (accessed through Domain & User > Domain > Domain) is enabled, each recipient address will be verified with the protected email server. For email destined for invalid recipient addresses, the FortiMail unit will return User Unknown messages to the SMTP client. However, spammers will utilize this response to guess and learn valid recipient addresses.

To prevent this, enable Enable sender reputation in session profiles (located in Profile > Session > Session). Sender reputation weighs each SMTP client’s IP address and assigns them a score. If the SMTP client sends several email messages to unknown recipients, the sender’s reputation score is increased significantly. When the sender reputation score exceeds the threshold, the SMTP client’s SMTP sessions are terminated at connection level.

• To prevent delivery status notification (DSN) spam, enable bounce verification.

Spammers may sometimes use the DSN mechanism to bypass antispam measures. In this attack, sometimes called “backscatter”, the spammer spoofs the email address of a legitimate sender and intentionally sends spam to an undeliverable recipient, expecting that recipients' email servers will send a DSN back to senders to notify them of the delivery failure. Because this attack utilizes innocent email servers and a standard notification mechanism, many antispam mechanisms may be unable to detect the difference between legitimate and spoofed DSN.

To prevent this, enable bounce address tagging and verification (located in Security > Bounce Verification > Setting) and configure it with an active key. In addition, disable both the Bypass bounce verification option (located in Domain & User > Domain > Domain) and the Bypass bounce verification check option (located in Profile > Session > Session). It is also recommended to select Use antispam profile settings for the Bounce verification action option (located in Security > Bounce Verification > Setting). Finally, verify that all email, both incoming and outgoing, is routed through the FortiMail unit. The FortiMail unit cannot tag email, or recognize legitimate DSN for previously sent email, if all email does not pass through it.