<profile_name>

Enter the name of the weighted-analysis profile.

comment <comment_str>

Enter a descriptive comment.

<order_index>

Enter the numerical order of the rule in the profile.

status {enable | disable}

Enable or disable the rule.

threshold <score_float>

Enter the minimum total score that triggers the action.

The total score is determined by adding all weighted scores in the rule (cousin-domain-score, etc.).

dictionary-profile <profile_name>

Enter the name of a dictionary profile that contains words or phrases that typically only spam has.

Keywords are often a "call to action" that motivates the user to reply or click a hyperlink. For example, "Click here", "transfer", "money", "dollars", "bank account", "conference attendee", etc.

dictionary-threshold <limit_int>

Enter the threshold for dictionary profile matches.

When the dictionary profile scans an email, it counts the number of matching words or phrases, and adjusts this total according to pattern-weight <weight_int> and pattern-max-weight <weight_int>. If the result equals or exceeds this threshold, then FortiMail applies the weighted score defined in action-keyword-score <score_float>.

intelligent-analysis-score <score_float>

Enter a weight-adjusted score for intelligent analysis detections.

Multiple factors contribute to intelligent spam analysis in order to reduce false positives, including:

• SPF
• DKIM
• DMARC
• matching of sender addresses in the message headers (From: and Reply-To:)
• newly registered domain names that do not have a FortiGuard Antispam rating yet
• header analysis
• malformed email detection

Enter a weight-adjusted score for malformed emails.

Malformed emails are those emails that contain malformed data in the email structure, header, or body. For more information, see RFC 7103.

relationship-strong-score <threshold_int>

Enter the score for strong or weak relation result obtained from querying FortiGuard Sender and Recipient Relationship (SRR).

FortiGuard Social Database contains the social mapping of the email communication flow. For example, if user1@1.example.com and user2@2.example.com have regular communication, then their SRR is strong; if they have no history of communication before, then their SRR is weak.

relationship-weak-score <threshold_int>

Enter the score for weak relation result obtained from querying FortiGuard Sender and Recipient Relationship (SRR).

sender-alignment-score <score_float>

Enter a weight-adjusted score for sender domain mismatches.

Sender alignment compares the message header (From: and Reply-to:) with the SMTP envelope (MAIL FROM:) to look for a mismatch, which is typical of spam.

suspicious-character-score <score_float>

Enter a weight-adjusted score for suspicious characters.

Detects internationalized domain name (IDN) homograph attacks. If domain names in URLs, sender email addresses, or recipient email addresses have Unicode characters that are from different languages yet look similar (for example, A looks similar in Cyrillic, Greek, and Latin alphabets), then an attacker could trick the user into using a fraudulent website or email. FortiMail detects these as suspicious.

url-profile <profile_name>

Enter the name of a URL profile detect spam or phishing hyperlinks in email.