Configuring protected domains

The Domain tab displays the list of protected domains and domain groups.

Protected domains define connections and email messages for which the FortiMail unit can perform protective email processing by describing both the:

• IP address of an SMTP server
• domain name portion (the portion which follows the @ symbol) of recipient email addresses in the SMTP envelope (RCPT TO:)

The FortiMail unit uses both parts to compare to connections and email messages when looking for traffic that involves the protected domain.

For FortiMail units operating in server mode, protected domains list only the domain name, not the IP address: the IP address of the SMTP server is the IP address of the FortiMail unit itself.

For example, if you wanted to scan email from email addresses such as user.one@example.com hosted on the SMTP server 10.10.10.10, you would configure a protected domain of example.com whose SMTP server is 10.10.10.10.

Aside from defining the domain, protected domains contain settings that apply specifically to all email destined for that domain, such as mail routing and disclaimer messages.

With an advanced management feature license, domain groups can be created and used to associate to domain-level administrators, allowing administrators to potentially manage multiple domains and all log entries associated with their domains. Domain-level administrators may search history logs, with the results filtered based on the user's domain.

Many FortiMail features require that you configure a protected domain. For example, when applying recipient-based policies for email messages incoming to the protected domain, the FortiMail unit compares the domain name of the protected domain to the domain name portion of the recipient email addresses.

When FortiMail units operating in transparent mode are proxying email connections for a protected domain, the FortiMail unit will pass, drop or intercept connections destined for the IP address of an SMTP server associated with the protected domain, and can use the domain name of the protected domain during the SMTP greeting.

Usually, you have already configured at least one protected domain during installation of your FortiMail unit; however, some configurations may not require any protected domains. You can add more domains or modify the settings of existing ones if necessary.

If you have many mail domains that will use identical settings, instead of creating many protected domains, you may want to create one protected domain, and then configure the others as associated domains. For details, see Domain Association.

If the FortiMail unit is operating in gateway mode, you must change the MX entries for the DNS records for your email domain, referring email to the FortiMail unit rather than to your email servers. If you create additional protected domains, you must modify the MX records for each additional email domain. Similarly, MX records must also refer to the FortiMail unit if it is operating in server mode.

To configure a protected domain

1. If the protected domain will use an IP pool profile, configure the IP pool profile. For details, see Configuring IP pools.

2. Go to Domain & User > Domain > Domain.

   The tab varies with the operation mode.

   GUI item	Description
   Delete (button)	Click Delete to remove the protected domain. Caution: This also deletes all associated email user accounts and preferences.
   Domain FQDN	The fully qualified domain name (FQDN) of the protected domain. If the protected domain is a subdomain or domain association, click the + next to a domain entry to expand the list of subdomains and domain associations. To collapse the entry, click the -.
   Relay Type ( transparent and gateway mode only)	How the SMTP server will receive email from the FortiMail unit for the protected domain, either: Host MX Record (this domain) MX Record (alternative domain) IP Group LDAP Domain Mail Host
   SMTP server ( transparent and gateway mode only)	The host name or IP address and port number of the mail exchanger (MX) for the protected domain. If Relay type is MX Record (this domain) or MX Record (alternative domain), this information is determined dynamically by querying the MX record of the DNS server, and this field will be empty.
   Recipient Verification ( transparent and gateway mode only)	The SMTP server or LDAP server used for recipient address verification, if it is enabled.
   Sub ( transparent and gateway mode only)	The number of subdomains for each protected domain.
   Association ( transparent and gateway mode only)	The number of domain associations for the protected domain. See also Domain Association.
   MTA Status ( transparent and gateway mode only)	The status of the SMTP server for the protected domain.
   Active User	The number of .active mailboxes. See Active mailbox user list.
   Disk Usage (%) ( transparent and gateway mode only)	The disk space used by quarantine reports in kilobytes (KB).

3. Either click New to create a new protected domain, or click a row to modify it.

   A dialog appears. Its options vary with the operation mode.

4. Configure the settings that apply to the operation mode and your choice for relay type:

   GUI item		Description
   Domain name		Enter the fully qualified domain name (FQDN) of the protected domain. For example, if you want to protect email addresses such as user1@example.com, you would enter the protected domain name example.com. Generally, your protected domain will use a valid, globally-resolvable top-level domain (TLD) such as .com. Exceptions could include testing scenarios, where you have created a .lab mail domain on your private network to prevent accidental conflicts with live mail systems legitimately using their globally-resolvable FQDN.
   Is subdomain		Mark this check box to indicate the protected domain you are creating is a subdomain of an existing protected domain, then also configure Main domain. Subdomains, like their parent protected domains, can be selected when configuring policies specific to that subdomain. Unlike top-level protected domains, however, subdomains will appear as grouped under the parent protected domain when viewing the list of protected domains. This option is available only when another protected domain exists to select as the parent domain.
   	Main domain	Select the protected domain that is the parent of this subdomain. For example, lab.example.com might be a subdomain of example.com. This option is available only when Is subdomain is enabled.
   Relay type ( transparent and gateway mode only)		Select from one of the following methods of defining which SMTP server will receive email from the FortiMail unit that is destined for the protected domain: Host: Configure the connection to one protected SMTP server or, if any, one fallback. Also configure SMTP server and Fallback SMTP server. MX Record (this domain): Query the DNS server’s MX record of the protected domain name for the FQDN or IP address of the SMTP server. If there are multiple MX records, the FortiMail unit will load balance between them. MX Record (alternative domain): Query the DNS server’s MX record of a domain name you specify for the FQDN or IP address of the SMTP server. If there are multiple MX records, the FortiMail unit will load balance between them. Also configure Alternative domain name. IP Group: Configure the connection to rotate among one or many protected SMTP servers for load balancing. Also configure IP group. LDAP Domain Mail Host: Query the LDAP server for the FQDN or IP address of the SMTP server. Also configure LDAP profile (see Configuring LDAP profiles). Note: If an MX option is used, you may also be required to configure the FortiMail unit to use a private DNS server whose MX and/or A records differ from that of a public DNS server. Requirements vary by the topology of your network and by the operating mode of the FortiMail unit.
   		In gateway mode, a private DNS server is required. On the private DNS server, configure the MX record with the FQDN of the SMTP server that you are protecting for this domain, causing the FortiMail unit to route email to the protected SMTP server. This is different from how a public DNS server should be configured for that domain name, where the MX record usually should contain the FQDN of the FortiMail unit itself, causing external SMTP servers to route email through the FortiMail unit. Additionally, if both the FortiMail unit and the SMTP server are behind a NAT device such as a router or firewall, on the private DNS server, configure the protected SMTP server’s A record with its private IP address, while on the public DNS server, configure the FortiMail unit’s A record with its public IP address. In transparent mode, a private DNS server is required if both the FortiMail unit and the SMTP server are behind a NAT device such as a router or firewall. On the private DNS server, configure the protected SMTP server’s A record with its private IP address. On the public DNS server, configure the protected SMTP server’s A record with its public IP address. Do not modify the MX record. For performance reasons, DNS lookups are skipped in gateway and server mode unless the sending domain is blank.
   SMTP server ( transparent and gateway mode only)		Enter the fully qualified domain name (FQDN) or IP address of the primary SMTP server for this protected domain, then also configure Port and Use SMTPS. If you have an internal mail relay that is located on a physically separate server from your internal mail server, this could be your internal mail relay, instead of your internal mail server. Consider your network topology, directionality of the mail flow, and the operation mode of the FortiMail unit. For more information, see Inbound versus outbound email and Avoiding scanning email multiple times. This field appears only if Relay type is Host.
   Fallback SMTP server ( transparent and gateway mode only)		Enter the fully qualified domain name (FQDN) or IP address of the secondary SMTP server for this protected domain, then also configure Port and Use SMTPS. This SMTP server will be used if the primary SMTP server is unreachable. This field appears only if Relay type is Host.
   IP group ( transparent and gateway mode only)		Select the name of the IP group that is the range of IP addresses. Also configure Port and Use SMTPS. This field appears only if Relay type is IP Group.
   LDAP profile ( transparent mode and gateway mode only)		Select the name of the LDAP profile that has the FQDN or IP address of the SMTP server you want to query. Also configure Port and Use SMTPS. This field appears only if Relay type is LDAP Domain Mail Host.
   	Port	Enter the port number on which the SMTP server listens. If you enable Use SMTPS, Port automatically changes to the default port number for SMTPS, but can still be customized. This field appears only if Relay type is Host, IP Group or LDAP Domain Mail Host. See also Appendix C: Port Numbers.
   Alternative domain name ( transparent and gateway mode only)		Enter the domain name to use when querying the DNS server for MX records. This option appears only if Relay type is MX Record (alternative domain name).
   LDAP User Profile (server mode only)		Select the name of an LDAP profile in which you have configured (see Configuring LDAP profiles), enabling you to authenticate email users and expand alias email addresses or replace one email address with another by using an LDAP query to retrieve alias members.
   Use SMTPS		Enable to use SMTPS for connections originating from or destined for this protected server. This field appears only if Relay type is Host, IP Group or LDAP Domain Mail Host.
   Relay Authentication		To test relay authentication, enable it and enter an email user name and password pair that exists on the mail server. Also specify the authentication type.
   Test (button)		After you have entered the relay server information, you can click the Test button to test if the relay server is accessible. To further test mail delivery, click Advanced Group, and enter the SMTP HELO/EHLO, sender (MAIL FROM:), and recipient (RCPT TO:) information. Click Test. The test results will be displayed. Note: STARTTLS is not supported for relay host testing.

To configure domain groups

1. Purchase the feature license and enable the feature. See Domain group support.

2. Go to Domain & User > Domain > Domain Group.

3. Click New, or select a row and click Edit to edit an existing group.

4. Enter a Group Name.

5. Click the domains that you want to add to the domain group from the Available text area, and click the right-arrow to bring them to the Members text area.

6. Click Create.

7. Configure the following sections:

   • Configuring recipient address verification
   • Configuring transparent mode options
   • Configuring removal of invalid quarantine accounts
   • LDAP Option section
   • Advanced Setting section
   • Mail Migration Settings section

Configuring recipient address verification

This section does not apply to server mode.

Select a method of confirming that the recipient email address in the message envelope (RCPT TO:) corresponds to an email user account that actually exists on the protected email server. If the recipient address is invalid, the FortiMail unit will reject the email. This prevents quarantine email messages for non-existent accounts, thereby conserving quarantine hard disk space.

This feature can impact performance and be noticeable during peak traffic times. For a lesser performance impact, you can alternatively periodically automatically remove quarantined email messages for invalid email user accounts, rather than actively preventing them during each email message.

1. Go to Domain & User > Domain > Domain.
2. Either click New to create a new protected domain, or click an row to modify it.

A dialog appears. Its options vary with the operation mode.

3. Expand the recipient address verification section.

4. Configure the following:

   GUI item	Description
   Disable	Do not verify that the recipient address is an email user account that actually exists.
   SMTP Server	Query the SMTP server using either the SMTP VRFY command or RCPT command to verify that the recipient address is an email user account that actually exists. RCPT is the default command. If you want to query an SMTP server other than the one you have defined as the protected SMTP server, also enable Use alternative server, then enter the IP address or FQDN of the server in the field next to it. Also configure Port with the port number on which the SMTP server listens, and enable Use SMTPS if you want to use SMTPS for recipient address verification connections with the server. See also Appendix C: Port Numbers. In case you want to use different sender email addresses in the SMTP envelope (MAIL FROM:) for different domains, set Mail from address to Use domain setting and specify the address to use. If you select Use system setting (the default setting), FortiMail will use an emtpy sender email address unless you specify a global one with the following CLI commands: config mailsetting smtp-rcpt-verification set mail-from-addr <sender_email> end Note: Microsoft 365 does not accept an empty MAIL FROM for SMTP recipient verification. You must specify an envelope from address if FortiMail is protecting Microsoft 365 domains. Additionally, set Action on invalid recipient to either reject any unknown users, or discard unknown users (initially accept and silently discard).
   LDAP Server	Query an LDAP server to verify that the recipient address is an email user account that actually exists. Also select the LDAP profile that will be used to query the LDAP server. For more information on configuring LDAP profiles, see Configuring LDAP profiles. Additionally, set Action on invalid recipient to either reject any unknown users, or discard unknown users (initially accept and silently discard).
   Imported User	Query an LDAP or Microsoft 365 server to verify that the imported users actually exist. For more information, see Managing imported users Additionally, set Action on invalid recipient to either reject any unknown users, or discard unknown users (initially accept and silently discard).

Configuring transparent mode options

This section appears only when the FortiMail unit operates in transparent mode.

1. Go to Domain & User > Domain > Domain.

2. Either click New to create a new protected domain, or click an row to modify it.

   A multi-section dialog appears. Its options vary with the operation mode.

3. Expand the transparent mode settings section.

4. Configure the following:

   GUI item	Description
   This server is on	Select the network interface (a port) to which the protected SMTP server is connected. Note: Selecting the wrong network interface will result in the FortiMail sending email traffic to the wrong network interface.
   Hide the transparent box	Enable to preserve the IP address or domain name of the SMTP client for incoming email messages in: the SMTP greeting (HELO/EHLO) in the envelope and in the Received: message headers of email messages the IP addresses in the IP header This masks the existence of the FortiMail unit to the protected SMTP server. Disable to replace the SMTP client’s IP address or domain name with that of the FortiMail unit. For example, an external SMTP client might have the IP address 172.168.1.1, and the FortiMail unit might have the domain name fortimail.example.com. If the option is enabled, the message header would contain (difference highlighted in bold):
   	Received: from 192.168.1.1 (EHLO 172.16.1.1) (192.168.1.1) by smtp.external.example.com with SMTP; Fri, 24 Jul 2008 07:12:40 -0800 Received: from smtpa ([172.16.1.2]) by [172.16.1.1] with SMTP id kAOFESEN001901 for <user1@external.example.com>; Fri, 24 Jul 2008 15:14:28 GMT But if the option is disabled, the message headers would contain: Received: from 192.168.1.1 (EHLO fortimail.example.com) (192.168.1.1) by smtp.external.example.com with SMTP; Fri, 24 Jul 2008 07:17:45 -0800 Received: from smtpa ([172.16.1.2]) by fortimail.example.com with SMTP id kAOFJl4j002011 for <user1@external.example.com>; Fri, 24 Jul 2008 15:19:47 GMT Note: If the protected SMTP server applies rate limiting according to IP addresses, enabling this option can improve performance. The rate limit will then be separate for each client connecting to the protected SMTP server, rather than shared among all connections handled by the FortiMail unit. Note: Unless you have enabled Take precedence over recipient based policy match in the IP-based policy, this option supercedes the Hide this box from the mail server option in the session profile, and may prevent it from applying to incoming email messages.
   Use this domain’s SMTP server to deliver the mail	Enable to use the protected SMTP server, instead of the FortiMail built-in MTA, to deliver outgoing email messages from the SMTP clients whose sending MTA is the protected SMTP server. For example, if the protected domain example.com has the SMTP server 192.168.1.1, and an SMTP client for user1@example.com connects to it to send email to user2@external.example.net, enabling this option would cause the FortiMail unit to pass the mail message via its built-in MTA to the protected SMTP server, which will deliver the message. Disable to relay email using the built-in MTA to either the SMTP relay defined in Configuring SMTP relay hosts, if any, or directly to the MTA that is the mail exchanger (MX) for the recipient email address’s (RCPT TO:) domain. The email may not actually travel through the protected SMTP server, even though it was the relay originally specified by the SMTP client. This option does not affect incoming connections containing incoming email messages, which will always be handled by the built-in MTA. For details, see When FortiMail uses the proxies instead of the built-in MTA. Note: This option will be ignored for email that matches an antispam or content action profile.

Configuring removal of invalid quarantine accounts

This section does not apply to server mode.

Select a method by which to periodically remove quarantined spam for which an email user account does not actually exist on the protected email server.

If you select either SMTP or LDAP server, the FortiMail unit queries the server daily (at 4:00 AM daily unless configured for another time in the CLI; see the FortiMail CLI Reference) to verify the existence of email user accounts. If an email user account does not currently exist, the FortiMail unit removes all spam quarantined for that email user account.

In some instances, recipient verification is not always feasible via SMTP or LDAP. Select Purge Inactive to remove any inactive accounts.

If you have also enabled Recipient Address Verification (see Configuring recipient address verification), the FortiMail unit does not form quarantine accounts for email user accounts that do not exist on the protected email server. In that case, invalid quarantine accounts are never formed, and this option may not be necessary, except when you delete email user accounts on the protected email server. If this is the case, you can improve the performance of the FortiMail unit by disabling this option.

1. Go to Domain & User > Domain > Domain.

2. Either click New to create a new protected domain, or click an row to modify it.

   A multi-section dialog appears. Its options vary with the operation mode.

3. Expand the Automatic Removal of Invalid Quarantine Accounts section.

4. Configure the following:

   GUI item	Description
   Disable	Do not verify that the recipient address is an email user account that actually exists.
   SMTP Server	Query the SMTP server to verify that the recipient address is an email user account that actually exists.
   LDAP Server	Query an LDAP server to verify that the recipient address is an email user account that actually exists. Also select the LDAP profile that will be used to query the LDAP server. For more information on configuring LDAP profiles, see Configuring LDAP profiles.
   Purge Inactive	Checks how many days an email user account has been inactive. If the account has been inactive for more than the designated Retention period, the account is purged.

LDAP Option section

Use this section to configure the LDAP service usages.

1. Go to Domain & User > Domain > Domain.

2. Either click New to create a new protected domain, or click an row to modify it.

   A multisection dialog appears. Its options vary with the operation mode.

3. Expand the LDAP Option section.

4. Configure the following:

   GUI item	Description
   User alias / address mapping profile ( transparent and gateway mode only)	Select the name of an LDAP profile in which you have enabled and configured, enabling you to expand alias email addresses or replace one email address with another by using an LDAP query to retrieve alias members and/or address mappings. To use this option make sure that the email alias and/or address mappings do exist on the LDAP server. If the alias cannot be retrieved or LDAP server is not accessible, the email will be temp failed (451 error). For more information, see Configuring LDAP profiles.
   Mail routing LDAP profile	Enable to perform mail routing, then click the arrow to expand the options and select the name of an LDAP profile in which you have enabled and configured. For more information, see Configuring LDAP profiles.
   Scan override profile	Enable to query an LDAP server for an email user’s preferences to enable or disable antispam, antivirus, and/or content processing for email messages destined for them, then select the name of an LDAP profile in which you have enabled and configured. For more information, see Configuring LDAP profiles.

Advanced Setting section

Go to Domain & User > Domain > Domain and expand the Advanced Setting section to configure the following domain settings:

• Quarantine Report Setting
• Domain Association
• DKIM and ARC Setting
• DMARC Report Setting
• Disclaimer
• Sender Address Rate Control
• Other

Quarantine Report Setting

The Quarantine Report Setting section that appears when configuring a protected domain lets you configure quarantine report settings. You can choose either to use the system-wide quarantine report settings or to configure domain-wide settings.

For information on system-wide quarantine report settings and quarantine reports in general, see Configuring global quarantine report settings and Customizing custom messages, email templates, GUI and Security Fabric.

To configure per-domain quarantine report settings

1. Go to Domain & User > Domain > Domain.

2. Either click New to create a protected domain or double-click a domain to modify it.

3. Expand the Advanced Setting section.

4. Click Quarantine Report Setting.

   A new dialog appears.

5. Configure the following:

   GUI item		Description
   Report destination
   	Original recipient	Enable to send the quarantine report to all recipients. For more information, see Managing the personal quarantines.
   	Other recipient	Select to send the quarantine report to a recipient other than the individual recipients or group owner. For example, you might delegate quarantine reports by sending them to an administrator whose email address is not locally deliverable to the protected domain, such as admin@lab.example.com.
   	LDAP group owner based on LDAP profile	Enable to send the quarantine report to a group owner, rather than individual recipients, then select the name of an LDAP profile in which you have enabled and configured the group query options (see Group Query. Also configure the following two options for more granular control: Only when original recipient is group When group owner is found, do not send to original recipient
   Report schedule		Click the arrow to expand the options.
   	Schedule	Select the schedule to use when sending quarantine reports. System settings: Use the system-wide quarantine report schedule. For more information, see Configuring global quarantine report settings. Domain settings: Use a quarantine report schedule that is specific to this protected domain. Also configure These Hours and These Days.
   	These Hours	Select which hours to send the quarantine report for this protected domain. This option is available only when Schedule is Use domain settings.
   	These Days	Select which days to send the quarantine report for this protected domain. This option is available only when Schedule is Use domain settings.
   Report template		Select an email template to use. If you choose to use the system settings, you can view the template but cannot edit from this page. But you can edit the system-wide template by going to System > Customization > Custom Email Template. If you choose to use the domain settings, you can click Edit to modify the template.

   Replacement messages often include variables, such as the MIME type of the file that was overwritten by the replacement message.

   Typically, you will customize text, but should not remove variables from the replacement message. Removing variables may result in an error message and reduced functionality. For example, removing %%SPAM_DELETE_URL%% would make users incapable of using the quarantine report to delete email individually from their personal quarantines.

6. Click Create or OK.

Domain Association

When configuring a protected domain, you can configure associated domains. An associated domain uses the settings of the protected domain or subdomain with which it is associated.

Domain associations can be useful for saving time when you have multiple domains, and you would otherwise need to configure multiple protected domains with identical settings.

For example, if you have one SMTP server handling email for ten domains, you could:

• Create ten separate protected domains and configure each with identical settings.
• Create one protected domain and list the nine other domains as domain associations.

The advantage of using the second method is that you do not have to repeatedly configure the same things when creating or modifying the protected domains. This saves time and reduces chances for error. Changes to one protected domain automatically apply to all of its associated domains.

The maximum number of domain associations that you can create is separate from the maximum number of protected domains.

Domain associations do not appear if FortiMail is operating in server mode.

To configure domain associations

1. Go to Domain & User > Domain > Domain.

2. Click New to create a protected domain or double-click a domain to modify it.

3. Under Advanced Setting, click Domain Association.

4. If the relay type of this protected domain uses MX record (this domain) or MX record (alternative domain), for the MX record lookup option of the domain associations, you can choose to use the domain association’s (self) MX record, or this protected domain’s (parent) MX record.

   To create a domain association, click New and enter the fully qualified domain name (FQDN) of a mail domain that will use the same settings as the same protected domain. You can use wildcard, such as *.example.com.

5. Click Create.

   The name of the associated domain appears in the Members area.

6. Repeat the previous steps for all domains that you want to associate with this protected domain.

7. Click Create or OK.

DKIM and ARC Setting

To prove that an email's message headers and body content have not been tampered with during transit, you can sign outgoing email using DomainKeys Identified Mail (DKIM; RFC 4871) and/or Authenticated Received Chain (ARC; RFC 8617).

RFC 1918 private network addresses are not globally unique, cannot be resolved by public DNS on the Internet, and therefore their email cannot be signed by DKIM or ARC.

With DKIM, the sender's MTA (such as FortiMail) adds a DKIM-signature: message header which contains a:

• Checksum/hash (bh= value) of the original email's content and message headers. Proves integrity.

• Signature (b= value) of the hash by the MTA. Proves authenticity.

DKIM signatures (and its predecessor, DomainKeys) use a public-private key pair. Private keys are used by the sender's MTA to sign email. Public key are stored in each domain name's DNS TXT record. To validate an email's DKIM signature, the recipient's email server queries the public DNS server about the domain and gets the public keys.

To determine which private key to sign with, FortiMail looks at the domain name in the:

1. Sender email address in the message headers (From:), or, if none,

2. Sender email address in the SMTP envelope (MAIL FROM:).

For associated domains, there is no separate key pair; FortiMail instead reuses the parent domain's private key. Public DNS records therefore have the same public key too.

DKIM does not always work, however.

Sometimes email is not delivered directly to recipients' email servers. Mail relays and proxies between the sender and recipient ("hops") may have legitimate reasons to change the original email, such as:

• tagging the subject line

• adding disclaimers and unsubscribe links

• bundling multiple email together into mailing list digests

• sending from a different source IP address (forwarding service)

and this invalidates the original SPF and/or DKIM hash and signatures.

To solve this problem, ARC sealing extends the DKIM solution. The relay or proxy validates the original SPF and/or DKIM authentication results on behalf of the recipient, and then provides an alternative signature.

After processing email, the relay or proxy adds ARC headers:

• ARC-Authentication-Results: Result of the original SPF and/or DKIM signature verification, before processing invalidated them.

• ARC-Message-Signature: Similar to DKIM, a checksum/hash of the email's message headers and body, except for ARC headers.

• ARC-Seal: Signature of the results and hash by the relay or proxy (or, if there are multiple relays and proxies, a signing chain similar to a certificate signing chain). Used to validate the previous ARC headers.

Then recipients or other relays and proxies can query a public DNS server to validate the ARC signature, and may use those results instead of SPF or DKIM. (For example, on FortiMail, you can enable ARC override.)

To configure DKIM and/or ARC validation and signing

1. Go to Domain & User > Domain > Domain.

2. Double-click to modify a protected domain.

   DKIM and ARC settings do not appear until after you save a new domain.

3. Expand the Advanced Setting section.

4. Click DKIM and ARC Setting.

5. Click New.

   In New selector, enter a unique name for the key pair, such as example_com_v2.

   In Key, select either:

   • Auto Generation: Generate a public-private key pair on the FortiMail unit.

   • Manual Import: Upload an existing public key and private key file in PEM format. If the private key file was encrypted with a password, you must enter it in Password so that FortiMail can decrypt and use it.

     Private key backups must be stored in a secure location, similar to passwords. Ideally the private key file should be encrypted while at rest. Unauthorized access could allow others to sign email with your key, compromising security.

   Click OK.

6. Click the new selector and then click Download.

   Alternatively, click the down arrow next to theDownload button to select either Multi-string format or Single-string format.

7. On the domain name's authoritative public DNS server, put the public key in the TXT record. For details, see the documentation for your DNS server. For example:

   example_com._domainkey IN TXT "t=y; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5xvUazqp2sBovpfumPuR5xC+yDvGbfndyHZuVQdSHhwdKAdsfiyOa03iPniCfQEbuM0d+4/AoPyTXHHPFBBnChMMHkWgHYlRDm5UMjrH5J1zDT5OyFxUEur+NtfS6LF29Te+6vSS+D3asfZ85V6WJDHSI9JV0504uwDeOOh/aewIDAQAB"

   Wait for the DNS records to propagate. Time required varies but is often less than 24 hours. Recipients cannot validate signatures until this occurs.

   Do not remove old public keys if recipients still need them to validate previously sent email.

8. On FortiMail, select the new key and then click Activate. (Only one key pair can be selected to sign with at a time.)

   In DKIM signing option and ARC sealing option, select either:

   • Disable:Do not sign.

   • Incoming:Sign email sent between users in the same protected domain.

   • Outgoing:Sign email sent from a protected domain to other external or protected domains. This includes email released from quarantine.

   • All: Sign both incoming and outgoing email.

   For example, if an IP-based policy matches both directions, but you only want to sign outgoing email, then select Outgoing.

   Click OK.

9. Click OK.

10. In the profile used by policies that match email that you want to DKIM or ARC sign, enable sender validation.

    Depending on the policy type, you may be able to use either:

    • Antispam profile: Enable SPF section, DKIM section, DMARC section, and/or ARC section. Use this method if you must validate existing ARC signatures from other relays or proxies before FortiMail adds its own signature to the signing chain.

    • Session profile: Enable SPF check and/or Enable DKIM check.

    When FortiMail validates SPF, DKIM, and/or ARC signatures, if the email direction matches DKIM signing option or ARC sealing option, then validation results are automatically signed.

DMARC Report Setting

You can configure DMARC report settings that are system-wide (see DMARC Report Generation), or specific to this protected domain.

To configure per-domain DMARC report and statistics

1. Go to Domain & User > Domain > Domain.

2. Either click New to create a protected domain or double-click a domain to modify it.

3. Click to expand Advanced Setting.

4. Click DMARC Report Setting.

5. Configure the following:

   GUI item	Description
   Report Generation
   Status	Select whether or not to send DMARC reports, and which settings to use: Enable — Collect DMARC check data. Each day, for each sender domain that matched a policy where DMARC checks are enabled, send a report to that domain's authorized DMARC report recipient. Also configure From address local part. Note: If a sender does not have a valid DMARC RUA/RUF configured in the domain's DNS TXT record, then even if you enable DMARC reports, FortiMail cannot send them to that domain because there is no report recipient email address. Tip: If you have the DMARC report analysis feature license, then you can instead use charts with statistics about DMARC reports.You can also generate DMARC reports on demand, and send them to other recipients. See Viewing DMARC report statistics, and the Status setting for analysis. Disable — Do not collect DMARC check data. Do not generate a report. Monitor Only — Collect DMARC check data, but do not generate a report. Use System Setting — Use the system-wide setting.
   From address local part	Enter the local part (username) that the FortiMail unit will use as its sender email address (From:) when it sends DMARC report email. Default is noreply. Change it if, for example, an administrator wants replies about DMARC reports. Also configure Status for report generation.
   Report Analysis
   Status	Select whether or not to include data from this protected domain in charts with current DMARC statistics that FortiMail administrators can use when they log in (see Viewing DMARC report statistics), either: Enable — Include data from this protected domain. Disable — Do not include data from this protected domain. Use System Setting — Use the system-wide setting.

Disclaimer

You can configure disclaimer messages that are system-wide (see Configuring global disclaimers), or specific to each protected domain.

A disclaimer message is text that is generally attached to email to warn the recipient that the email contents may be confidential, or other information required by law, such as unsubscribe links or physical addresses. For disclaimers added to outgoing messages, you must configure an IP-based policy or an outgoing recipient-based policy.

Disclaimer messages can be appended for either or both incoming or outgoing email messages.

Disclaimer insertion may invalidate existing DKIM signatures, requiring an alternative ARC signature. See DKIM and ARC Setting.

To configure a per-domain disclaimer messages

1. Go to System > Mail Setting > Disclaimer.
2. Enable Allow per-domain settings.
3. If FortiMail is operating in transparent mode, also enable clients to send email using their specified SMTP server. For more information, see Use client-specified SMTP server to send email.

4. Go to Domain & User > Domain > Domain.

5. Either click New to create a protected domain or double-click a domain to modify it.

6. Expand the Advanced Setting section.

7. Click Disclaimer.

   A new dialog appears.

8. Configure the following:

   GUI item		Description
   Setting		Select which type of disclaimer message to append. Disable: Do not append disclaimer messages. Use system setting: Append the system-wide disclaimer message. Use domain setting: Append the disclaimer messages configured specifically for this protected domain. For information about how to configure disclaimer messages, see Configuring global disclaimers. This option is only available only if you have enabled per-domain disclaimer messages. See Configuring global disclaimers.

Sender Address Rate Control

For users in each protected domain, you can rate control how much email each user can send.

1. Go to Domain & User > Domain > Domain.

2. Either click New to create a protected domain or double-click a domain to modify it.

3. Expand the Advanced Setting section.

4. Click Sender Address Rate Control.

   A new dialog appears.

5. Configure the following:

   GUI item	Description
   Status	Enable or disable the following rate limits.
   Action	Select which action to apply when a user exceeds any of the following rate limits. For details about actions, see Action.
   Exempt List	Click to define which SMTP clients are exceptions, and the rate limits in this protected domain do not apply to them.
   Maximum number of messages per half hour	Enter the maximum number of emails per user in each 30 minute time interval.
   Maximum number of recipients per half hour	Enter the maximum number of unique email recipient addresses per user in each 30 minute time interval.
   Maximum data size per half hour (MB)	Enter the maximum size, in megabytes (MB), per user in each 30 minute time interval.
   Maximum number of spam messages per half hour	Enter the maximum number of spam email per user in each 30 minute time interval. If the sender's email are often detected as spam, then it is probable that they are intentionally sending unwanted email (not by accident).
   Send notification upon rate control violation	If the user directly connects to FortiMail to send email, then Action will indicate to the user that their email was not accepted. Otherwise (or if you want to provide a detailed explanation), configure this option to send an explanation email to the user. See Configuring notification profiles.

See also

Use client-specified SMTP server to send email

Configuring global disclaimers

Incoming versus outgoing email

Configuring protected domains

Other

This section contains miscellaneous settings for the protected domain.

1. Go to Domain & User > Domain > Domain.

2. Either click New to create a new protected domain, or click an row to modify it.

   A multi-section dialog appears. Its options vary with the operation mode.

3. Expand the Advanced Setting section.

4. Click Other.

   A new dialog appears.

5. Configure the following:

   GUI item	Description
   Webmail theme	Either use the system setting or choose a color to overwrite the system setting.
   Webmail language	Select either to use the default system language or a different language that the FortiMail unit will use to display webmail and quarantine folder pages. By default, the FortiMail unit uses the same language as the GUI. For more information, see Customizing the GUI appearance.
   Disk quota (GB)	Enter the disk quota in gigabytes (GB). If the maximum disk quota of this domain is exceeded, users of this domain will no longer receive any new email. If the disk quota reaches 90% threshold, a warning email is sent to the domain customer email. For instances where a resource profile disk quota is set to 0, the domain quota is enforced. Setting any value on resource profile higher than the domain quota value results in the domain quota value being imposed. Resource profile quota values are imposed instead when they are lower than the domain quota. Note: This option is only available in server mode.
   Webmail single sign on	For webmail SSO, enable the service and select an SSO profile from the dropdown menu. For more information, see Configuring single sign-on (SSO).
   Maximum message size (KB)	Enter the limit in kilobytes (KB) of the message size. Email messages over the threshold size are rejected. Note: If the same email message is sent to recipients in multiple protected domains and the maximum message size limits in the domain settings are different, the smallest size setting will take effect and thus the email won't be delivered to any recipients. In this case, you can use the maximum message size setting in the content profile instead (under Profile > Content > Content). However, you can use the reject action only for separate SMTP sessions, not for one same session. Note: When you configure session profile settings under Profile > Session > Session, you can also set the message size limit. Here is how the two settings work together: For outgoing email, only the size limit in the session profile will be matched. If there is no session profile defined or no IP-based policy matched, the default size limit of 10 MB will be used. For incoming email, the size limits in both the session profile and domain settings will be checked. If there is no session profile defined or no IP-based policy matched, the default size limit of 10 MB will be compared with the size limit in the domain settings. The smaller size will be used.
   SMTP greeting (EHLO/HELO) Name (As Client)	Select how the FortiMail unit will identify itself during the HELO or EHLO greeting when delivering mail to the protected SMTP server as a client. Use this domain name: The FortiMail unit will identify itself using the domain name for this protected domain. If the FortiMail unit will handle internal email messages (those for which both the sender and recipient addresses in the envelope contain the domain name of the protected domain), to use this option, you must also configure your protected SMTP server to use its host name for SMTP greetings. Failure to do this will result in dropped SMTP sessions, as both the FortiMail unit and the protected SMTP server will be using the same domain name when greeting each other. Use system host name: The FortiMail unit will identify itself using its own host name. This is the default setting. Use other name: Specify a greeting name if you want to use a customized host name. This setting does not apply if email is incoming, according to the sender address in the envelope, from an unprotected domain.
   IP pool	You can use a pool of IP addresses as the source IP address when sending email from this domain, or as the destination IP address when receiving email destined to this domain, or as both the source and destination IP addresses. If you want to use the IP pool as the source IP address for this protected domain, according to the sender’s email address in the envelope (MAIL FROM:), select the IP pool to use and select Delivering as the Direction. If you want to use the IP pool as the destination IP address (virtual host) for this protected domain, according to the recipient’s email address in the envelope (RCPT TO:), select the IP pool to use and select Receiving as the Direction. You must also configure the MX record to direct email to the IP pool addresses as well. This feature can be used to support multiple virtual hosts on a single physical interface, so that different profiles can be applied to different host and logging for each host can be separated as well. If you want to use the IP pool as both the destination and source IP address, select the IP pool to use and select Both as the Direction. Each email that the FortiMail unit sends will use the next IP address in the range. When the last IP address in the range is used, the next email will use the first IP address. If the FortiMail unit is operating in transparent mode, and you have enabled Hide the transparent box or Use client-specified SMTP server to send email, you cannot use IP pools. For more information on IP pools, see Configuring IP pools.
   Remove received header of outgoing email	Enable to remove the Received: message headers from email whose: sender email address belongs to this protected domain recipient email address is outgoing (that is, does not belong to this protected domain); if there are multiple recipients, only the first recipient’s email address is used to determine whether an email is outgoing Alternatively, you can remove this header from any matching email using session profiles. See Received:.
   Use global Bayesian database	Enable to use the global Bayesian database instead of the Bayesian database for this protected domain. If you do not need the Bayesian database to be specific to the protected domain, you may want to use the global Bayesian database instead in order to simplify database maintenance and training. Disable to use the per-domain Bayesian database. Note: Train the global or per-domain Bayesian database before using it. If you do not train it first, Bayesian scan results may be unreliable. For more information on Bayesian database types and how to train them, see Types of Bayesian databases and Training the Bayesian databases.
   Bypass bounce verification	Mark this check box to disable bounce verification for this protected domain. This option appears only if bounce verification is enabled. For more information, see Configuring bounce verification and tagging.

Service Settings section

If you are a managed security service provider (MSSP) which host multiple domains for multiple customers, for billing purpose, the super admin may want to limit usage of FortiMail resources by each protected domain. Domain administrators are not allowed to modify these settings.

These features are available only if FortiMail is operating in server mode.

1. Go to Domain & User > Domain > Domain.

2. Either click New to create a new protected domain, or click an row to modify it.

3. Expand the Advanced Setting section.

4. Click Other.

   A new dialog appears.

5. Expand the Service Setting section.

6. Configure the following:

   GUI item	Description
   Enable domain level service settings	Select to enable the domain-level server controls.
   Email account limit	Specify the maximum number of email account are allowed on this domain.
   Max user quota (MB)	Specify the maximum disk quota for each user.
   Mail access	Specify the allowed mail access protocol for the users: POP3, IMAP, or Webmail.
   Webmail service type	For webmail access, if you select Limited Service, the users will be only able to change their passwords and configure mail forwarding. All other features will not be available.

Customer Information section

In each protected domain, you can make notes about the associated customer account.

1. Go to Domain & User > Domain > Domain.

2. Either click New to create a new protected domain, or click an row to modify it.

   A multi-section dialog appears. Its options vary with the operation mode.

3. Expand the Customer Information section.

4. Configure the following:

   GUI item	Description
   Name	Enter the customer name.
   Email	Enter the customer email address.
   Account limit	Enter the user account limit.
   Description	Optional. Enter a description or comment.

Mail Migration Settings section

If FortiMail is operating in server mode, and you enable the mail migration feature, this section will appear. For details, see Migrating email from other mail servers (server mode only).