In action profiles (see Configuring antispam action profiles, Configuring antivirus action profiles, and Configuring content action profiles), you can select an action:

• Deliver to alternate host

• Deliver to original host

• System quarantine

• Personal quarantine

• Disclaimer insertion

• Subject tag location

• Replacement message location

For delivery and quarantine actions, you can select which form of the email to use:

• Modified copy — Modify the email according to the action.

• Unmodified copy — Original email header and body.

  If the email is in its original form, the recipient in the SMTP envelope(RCPT TO:) still might be rewritten by the action.

For example, when the HTML content is converted to text, if you choose to deliver the unmodified copy, then the HTML version will be delivered; if you choose to deliver the modified copy, then the plain text version will be delivered.

For Disclaimer insertion, you can choose to insert the disclaimer in selected or all messages.

For Subject tag location, you can choose to insert the tag at the start or end of the subject line.

If the action in a profile is one of the final actions, such as System quarantine, while the action in another profile is to deliver to the original host or alternate host, you can enable this option to override the final action.

For spam that is sent to personal quarantine, you can either continue or stop further scans of the email's attachments.

Specify the following:

• Maximum level to decompress archive file — Enter how many levels to decompress the archived files for antivirus and content scan. Valid range is 1 to 36. Default value is 12.

• Maximum archive file size to decompress (MB) — Enter the maximum file size to scan after the archived files are decompressed. This applies to every single file after decompression. Bigger files will not be scanned. Default value is 10MB.

• Maximum compression ratio for archive bomb — Enter the maximum compression ratio for FortiMail to decompress. Valid range is 1 to 1000. Default value is 200.

Select either:

• Action profile — Use the action specified in the antispam profile.

• Action profile with none — If the policy option in the sender's DMARC record is p=none, use that action. Else use the action in the antispam profile.

• DMARC record policy — Use the actions specified in the policy option of the sender's DMARC record.

The default setting is Action profile with none.

This system-wide setting can be overridden by a per-domain setting. For details, see the FortiMail CLI Reference.

Select either:

• Enable — Collect DMARC check data. Each day, for each sender domain that matched a policy where DMARC checks are enabled, send a report to that domain's authorized DMARC report recipient.

  Also configure Sender address local part.

  Note: If a sender does not have a valid DMARC RUA/RUF configured in the domain's DNS TXT record, then even if you enable DMARC reports, FortiMail cannot send them to that domain because there is no report recipient email address.

  Tip: If you have the DMARC report analysis feature license, then you can instead use charts with statistics about DMARC reports.You can also generate DMARC reports on demand, and send them to other recipients. See Viewing DMARC report statistics and On-demand DMARC reports.

• Disable — Do not collect DMARC check data. Do not generate a report.

• Monitor Only — Collect DMARC check data, but do not generate a report.

This system-wide setting can be overridden by a per-domain setting. For details, see DMARC Report Setting.

Enter the local part (username) that the FortiMail unit will use as its sender email address (From:) when it sends DMARC report email.

Default is syslocal. Change it if, for example, an administrator wants replies about DMARC reports.

Also configure DMARC Report Generation.

Indicates whether the DMARC report analysis feature licence is valid. See also DMARC report analysis.

Email impersonation is one of the email spoofing attacks. It forges the email header to deceive the recipient because the message appears to be from a different source than the actual address.

To fight against email impersonation, you can map display names with email addresses and check email for the mapping.

You can choose whether the impersonation analysis uses manual mapping entries or dynamic entries. You can also use both types of entries.

• Manual — Use the entries you manually entered under Profile > AntiSpam > Impersonation.

• Dynamic — Use the entries automatically learned by the FortiMail mail statistics service. To enable this service, enable mailstat-service under config system global.

The default setting is Manual.