Configuring cousin domain profiles

Similar to impersonation profiles, cousin domain profiles help to mitigate domain impersonation risks. Similar to impersonation profiles that map display names, cousin domain profiles can map both inbound and outbound domain names to either be scanned or exempt from scanning. Domain names may be deliberately misspelled, either by character removal, substitution, and/or transposition, in order to make emails look as though they originate from trusted internal sources.

For example, if you configure a regular expression for the sender domain f?rtinet.com, it will match f0rtinet.com, but the legitimate and trusted sender domain fortinet.com will also be detected as a cousin domain. To avoid this, you can add fortinet.com into the exempt rules setting to avoid detecting it as spam.

To configure a cousin domain profile

1. Go to Profile > AntiSpam > Cousin Domain.

2. Either click New or Clone to add a profile, or double-click a profile to modify it.

   Alternatively, see Batch editing antispam profiles.

3. Configure the following:

   GUI item		Description
   Domain		Select which protected domain this profile belongs to, or System (all protected domains can use this profile). You can only see the domains that are permitted by your administrator profile. See About administrator account permissions and domains.
   Name		Enter a unique name for the profile.
   Comment		Enter a comment or description.

4. In the Domain Pattern section, select From, To, or Exempt.

5. Click New and then configure the following:

   GUI item	Description
   Domain name pattern	Enter the domain name to be mapped to the email address. You can use wildcard or regular expression.
   Pattern type	Select either: Wildcard Regular expression Look-alike A look-alike pattern can be configured to specifically check for instances of recipient domain typos. For example, if a domain such as fortinet.com is configured with pattern type set to look-alike, any similar misspelled domains, such as fort1net.com, are caught. See also Syntax. Since auto-detection is not applicable to outgoing policies, look-alike patterns are best suited for catching misspelled domains.

6. Repeat the previous step until you have entries that match all cousin domains.

7. Click Create or OK.

8. To apply a cousin domain profile, select it in an antispam profile. For details, see Business email compromise section.