<policy_name>

Enter the number that identifies the policy.

Note: The policy identifier number may be different from the order of evaluation. FortiMail units evaluate these policies in sequential order, starting at the top of the list. Only the first matching policy is applied.

For example, if you enter:

move 15 before 1

then policy 15 is evaluated for a match before policy 1.

To show the order of evaluation for the list of policies, enter:

config policy access-control delivery

get

comment "<comment_str>"

Enter a description or comment. If a comment exists, it is displayed as a tool tip when you mouse-over the ID column in the list of policies in the GUI.

destination <destination_ipv4/mask>

Enter an IP address and netmask.

For example, enter 10.10.10.10/24 to match a 24-bit subnet, or all addresses starting with 10.10.10. This will appear as 10.10.10.0/24 in the policy list, where the 0 at the end indicates that any value matches in that position.

Similarly, 10.10.10.10/32 will appear as 10.10.10.10/32 and match only the 10.10.10.10 address.

To match any address, enter 0.0.0.0/0.

This setting is available only if destination-ip-type {ip-group | ip-mask} is ip-mask.

destination-ip-group <group_name>

Enter an IP address group.

This setting is available only if destination-ip-type {ip-group | ip-mask} is ip-group.

destination-ip-type {ip-group | ip-mask}

If you configured tls-profile <profile_name>, then select how you will define the destination IP addresses and netmasks that match the policy, either:

• ip-group: An IP address group. Also configure destination-ip-group <group_name>.
• ip-mask: An IP address and netmask. Also configure destination <destination_ipv4/mask>.

encryption-profile <profile_name>

If you want to apply S/MIME or IBE encryption to the email, select a profile.

Note: If you select IBE in profile content-action but S/MIME in encryption-profile <profile_name>, then IBE is overridden and not used. destination <destination_ipv4/mask> does not affect whether to apply the encryption profile.

ip-pool-profile <profile_name>

Enter an IP pool profile that FortiMail will use as its source IP address when it delivers email.

recipient-pattern <recipient_pattern>

Enter an email address or pattern. Formatting is the same as sender-pattern <sender_pattern>.

This setting is available only if recipient-pattern-type {default | group | ldap | regexp} is default or regexp.

recipient-pattern-group <group_name>

Enter the group of recipient email addresses.

This setting is available only if recipient-pattern-type {default | group | ldap | regexp} is group.

recipient-pattern-ldap-groupname <group_str>

Enter the group of recipient email addresses that is in the directory server.

This setting is available only if recipient-pattern-type {default | group | ldap | regexp} is ldap.

Note: Use $m in the LDAP query string to match recipient email addresses.

recipient-pattern-ldap-profile <profile_name>

Enter an LDAP profile.

This setting is available only if recipient-pattern-type {default | group | ldap | regexp} is ldap.

recipient-pattern-type {default | group | ldap | regexp}

Select how you will define the recipient email addresses that match the policy.

Options are the same as sender-pattern-type {default | group | ldap | regexp}.

sender-pattern <sender_pattern>

Depending on your selection in sender-pattern-type {default | group | ldap | regexp}:

• For default: Enter a complete or partial email address. Wild card characters can be used to match multiple email addresses. An asterisk (*) represents one or more characters. A question mark (?) represents any single character. For example:

  *@example.???

  matches all email addresses at example.com, example.net, example.org, or any other “example" domain ending with a three‑letter top-level domain name.

• For regexp: Enter a regular expression.

  Tip: To validate syntax and correct matching, you can use the validator in the FortiMail GUI. For details, see the FortiMail Administration Guide.

This setting is available only if sender-pattern-type {default | group | ldap | regexp} is default or regexp.

sender-pattern-group <group_name>

Enter the group of recipient email addresses.

This setting is available only if sender-pattern-type {default | group | ldap | regexp} is group.

sender-pattern-ldap-groupname <group_str>

Enter the group of recipient email addresses that is in the directory server.

This setting is available only if sender-pattern-type {default | group | ldap | regexp} is ldap.

Note: Use $m in the LDAP query string to match sender email addresses.

sender-pattern-ldap-profile <profile_name>

Enter an LDAP profile.

This setting is available only if sender-pattern-type {default | group | ldap | regexp} is ldap.

sender-pattern-type {default | group | ldap | regexp}

Select how you will define the sender email addresses that match the policy, either:

• default: An email address or wild card pattern that can match multiple email addresses. Also configure sender-pattern <sender_pattern>.
• group: A group of email addresses configured on the FortiMail unit. Also configure sender-pattern-group <group_name>.
• ldap: A group of email addresses configured on a directory server such as Microsoft Active Directory. Also configure sender-pattern-ldap-profile <profile_name> and sender-pattern-ldap-groupname <group_str>
• regexp: A regular expression that can match multiple email addresses. Also configure sender-pattern <sender_pattern>.

status {enable | disable}

Enable or disable this policy.