deadmail-expiry <time_int>

Enter the number of days to keep permanently undeliverable email in the dead mail folder. Dead mail has both incorrect recipient and sender email addresses, and can neither be delivered nor the sender notified.

The valid range is from 1 to 365 days.

default-auth-domain <domain_name>

Enter the domain to use for default authentication.

{default | incoming | outgoing}

Select the queue you want to configure.

defer-delivery-starttime <time_str>

Enter the time that the FortiMail unit will begin to process deferred oversized email, using the format hh:mm, where hh is the hour according to a 24-hour clock, and mm is the minutes.

defer-delivery-stoptime <time_str>

Enter the time that the FortiMail unit will stop processing deferred oversized email, using the format hh:mm, where hh is the hour according to a 24-hour clock, and mm is the minutes.

delivery-esmtp {no | yes}

Enter either:

yes: Disable the FortiMail unit from delivering email using ESMTP, and use standard SMTP instead.

no: Enable the FortiMail unit to deliver email using ESMTP if the SMTP server to which it is connecting supports the protocol.

delivery-failure-conditions {dns-failure | mta-failure-permanant | mta-failure-temporary | network-failure-connection | network-failure-other}

Specify the type of failed network connections the backup relay should take over and retry.

delivery-failure-handling-option {normal | relay-to-host}

When email delivery fails, you can choose to use the mail queue settings to handle the temporary or permanent failures. You can also try another relay that you know might work.

normal: Enter this option if you want to queue the email and use the mail queue settings.

relay-to-host: Enter another relay (backup relay) that you want to use for failed deliveries.

delivery-failure-host <host_name>

Enter a host to relay email when access to original mail host fails.

delivery-failure-min-age <minute_int>

Enter the time in minutes the undelivered email should wait in the normal queue before trying the backup relay.

delivery-tracking-status {enable | disable}

Enable to record the following mail delivery statuses in the history log:

• Delivered
• Blocked
• Failed
• Queued

You can view queued email except IBE email in the history log from the right-click pop-up menu. For security reasons, IBE email cannot be viewed in the queue.

dsn-ehlo-option {host-name | domain-name | other-name}

Specify the DSN EHLO/HELO argument to use:

• host-name: Use the host name of the FortiMail unit.
• domain-name: Use the local domain name of the FortiMail unit.
• other-name: Use a customized name specified in dsn-ehlo-other-name <name_str>.

dsn-ehlo-other-name <name_str>

If dsn-ehlo-option is set to other-name, use this command to enter the customized name.

dsn-email-attach-orig {enable | disable}

Enable to attach original email in delivery status notifications (DSN) or non-delivery reports (NDR).

dsn-email-customization-status {enable | disable}

Enable DSN (NDR) customization.

dsn-sender-address <email_str>

Enter the sender email address in DSN email messages sent by the FortiMail unit to notify email users of delivery failure.

If this string is empty, the FortiMail unit sends DSN from the default sender email address of “postmaster@example.com", where “example.com" is the domain name of the FortiMail unit.

dsn-sender-displayname <name_str>

Enter the display name of the sender email address for DSN.

If this string is empty, the FortiMail unit uses the display name “postmaster".

dsn-status {enable | disable}

Enable to allow DSN email generation.

imap-service {enable | disable}

Enable to allow IMAP service.

ip-pool-direction {all | exclude-internal-to-internal}

By default, IP pools in IP policies and domain settings will be applied to all email directions, including internal to internal, internal to external, external to internal, and external to external.

You can exempt IP pool usage for internal-to-internal email using the exclude-internal-to-internal option.

Note: IP pools in ACL delivery rules are still applied to internal-to-internal email.

ldap-domaincheck {enable | disable}

Enable to verify the existence of domains that have not been configured as protected domains. Also configure ldap-domaincheck-profile <profile_str> and ldap-domaincheck-auto-associate {enable | disable}.

To verify the existence of unknown domains, the FortiMail unit queries an LDAP server for a user object that contains the email address. If the user object exists, the verification is successful, the action varies by configuration of ldap-domaincheck-auto-associate {enable | disable}.

ldap-domaincheck-auto-associate {enable | disable}

If ldap-domaincheck is enable, select whether to enable or disable automatic creation of domain associations.

enable: The FortiMail unit automatically adds the unknown domain as a domain associated of the protected domain selected in ldap-domaincheck-internal-domain <domain_str>.

disable: If the DNS lookup of the unknown domain name is successful, the FortiMail unit routes the email to the IP address resolved for the domain name during the DNS lookup. Because the domain is not formally defined as a protected domain, the email is considered to be outgoing, and outgoing recipient-based policies are used to scan the email. For more information, see policy recipient.

ldap-domaincheck-internal-domain <domain_str>

If ldap-domaincheck is enable, and ldap-domaincheck-auto-associate is enable, enter name of the protected domain with which successfully verified domains will become associated.

ldap-domaincheck-profile <profile_str>

If ldap-domaincheck is enable, enter the name of the LDAP profile to use when verifying unknown domains.

local-domain-name <local-domain_str>

Enter the name of the domain to which the FortiMail unit belongs, such as example.com.

This option applies only if the FortiMail unit is operating in server mode.

pop3-port <port_int>

Enter the port number on which the FortiMail unit’s POP3 server will listen for POP3 connections. The default port number is 110.

This option applies only if the FortiMail unit is operating in server mode.

pop3-service {enable | disable}

Enable to allow POP3 service.

queue-dsn-timeout <timeout_int>

Enter the maximum number of days a delivery status notification (DSN) message can remain in the mail queues. If the maximum time is set to zero (0) days, the FortiMail unit attempts to deliver the DSN only once.

After the maximum time has been reached, the DSN email is moved to the dead mail folder.

The valid range is from zero to ten days.

queue-retry <interval_int>

Enter the number of minutes between delivery retries for email messages in the deferred and spam mail queues.

The valid range is from 10 to 120 minutes.

queue-timeout <timeout_int>

Enter the maximum number of hours that deferred email messages can remain in the deferred or spam mail queue, during which the FortiMail unit periodically retries to send the message.

After the maximum time has been reached, the FortiMail unit will send a final delivery status notification (DSN) email message to notify the sender that the email message was undeliverable.

The valid range is from 1 to 240 hours.

queue-warning <first-dsn_int>

Enter the number of hours after an initial failure to deliver an email message before the FortiMail unit sends the first delivery status notification (DSN) email message to notify the sender that the email message has been deferred.

After sending this initial DSN, the FortiMail unit will continue to retry sending the email until reaching the limit configured in timeout.

The valid range is from 1 to 24 hours.

relay-server-name <relay_name>

Specify the relay server to deliver outgoing email.

relay-server-status {enable |disable}

If enabled, the relay server will be used to deliver outgoing email. If disabled, the FortiMail built-in MTA will be used.

show-accept-cert-ca {enable | disable}

Enable to show acceptable client certificate ca.

smtp-auth {enable | disable}

Enable to accept the AUTH command to authenticate email users for connections using SMTP.

smtp-auth-over-tls {enable | disable}

Enable to accept the AUTH command to authenticate email users for connections using SMTP over TLS.

smtp-auth-smtps {enable | disable}

Enable to accept the AUTH command to authenticate email users for connections using SMTPS (SMTP with SSL).

smtp-delivery-addr-pref {ipv4-ipv6 | ipv6-ipv4 | ipv4 | ipv6}

When FortiMail delivers email to a host name, it does DNS AAAA and A record lookup.

Use this command to specify the IPv4/IPv6 delivery preferences:

• ipv4-ipv6: Try to deliver to the IPv4 address frist. If the IPv4 address is not accessible, try the IPv6 address. Because most MTAs support IPv4, this is the default setting.
• ipv6-ipv4: Try IPv6 first, then IPv4. However, if the AAAA record does not exist, the extra AAAA DNS lookup for IPv6 addresses will potentially cause email delivery delay.
• ipv4: Try IPv4 only. This setting is not recommended.
• ipv6: Try IPv6 only. This setting is not recommended.

smtp-delivery-session-preference {domain | host}

Google business email service does not accept multiple destination domains per SMTP transaction, resulting in repeated delivery attempts and delayed email. To work around this Google limitation, this command is added in 5.4.6 and 6.0.1 releases.

Before 5.4.6 and 6.0. releases, the default setting is host. Multiple recipient domains that resolve to the same MTA are sent to the server in the same session.

After 5.4.6 and 6.0.1 release, the default setting is changed to domain. Multiple recipient domains that resolve to the same MTA are sent to the server in separate sessions.

smtp-max-connections <connection_int>

Enter the maximum number of concurrent SMTP connections that FortiMail can accept from the STMP clients.

smtp-max-hop-count <number>

Enter the maximum number of hops that FortiMail can accept from the SMTP connections. Valid range is 1 to 200.

smtp-msa {enable | disable}

Enable to allow your email clients to use SMTP for message submission on a separate TCP port number from deliveries or mail relay by MTAs.

For details on message submission by email clients as distinct from SMTP used by MTAs, see RFC 2476.

smtp-msa-port <port_int>

Enter the TCP port number on which the FortiMail unit listens for email clients to submit email for delivery.

smtp-mtasts-status {check-all-domain | check-external-domain | disable}

Enable MTA Strict Transport Security (MTA-STS) domain checking:

• check-all-domain: FortiMail checks recipient domain MTA-STS records (including TLS version, format, and MTA-STS policy) for outgoing email to both internal and external domains.

• check-external-domain: FortiMail MTA-STS checking only when delivering outgoing emails to external domains.

• disable: Disable MTA-STS domain checking.

smtp-port <port_int>

Enter the port number on which the FortiMail unit’s SMTP server will listen for SMTP connections.

smtp-service {enable | disable}

Enable to allow SMTP service.

smtps-port <port_int

Enter the port number on which the FortiMail unit’s built-in MTA listens for secure SMTP connections.

smtps-tls-status {enable | disable}

Enable to allow SSL- and TLS-secured connections from SMTP clients that request SSL/TLS.

When disabled, SMTP connections with the FortiMail unit’s built-in MTA must occur as clear text, unencrypted.

timeout-connect <seconds_int>

Enter the maximum amount of time to wait, after the FortiMail unit initiates it, for the receiving SMTP server to establish the network connection.

The valid range is 10 to 120.

Note: This timeout applies to all SMTP connections, regardless of whether it is the first connection to that SMTP server or not.