Configuring an email filter profile

Use an email filter in a policy to perform spam detection and filtering.

FortiPortal includes two default email filter profiles. To use them, edit the desired email filter profile and enable Enable Spam Detection and Filtering. Configure the other settings as described below then save.

To configure an email filter profile:

1. Go to Security > Firewall Objects.

2. Select Email Filter Profile from the Security Profiles dropdown.

3. Click Create or select an existing profile from the list and click Edit.

4. In the form, enter the following information:

   Settings	Guidelines
   Name	Required. Enter a name for the profile.
   Comments	Optionally, enter comments.
   Feature Set	Select Flow-based or Proxy-based. For each mode, the following spam detection and filtering options are available: Flow-based: Spam Detection by Protocol for IMAP, POP3, and SMTP. Local Spam Filtering block/allow list. Proxy-based: Spam Detection by Protocol for IMAP, POP3, and SMTP. Spam Filtering features. Local Spam Filtering HELO DNS lookup, return email DNS check, and block/allow list.
   Enable Spam Detection and Filtering	Enable or disable spam detection and filtering. This essentially enables or disables this email filter profile.
   Spam Detection by Protocol	For each protocol, specify the spam action: Pass: Allow the email. Tag: Add notice in the email Subject or header (MIME). Discard: Discard the email. Only available for SMTP protocol.
   Local Spam Filtering
   Block/Allow List	Enable and select the local block/allow list to use for this filter.
   HELO DNS Lookup	Enable to perform a DNS lookup on the client domain name specified in the SMTP HELO command. If the lookup fails, emails delivered in this SMTP session are classified as spam. The HELO DNS lookup is only available for SMTP traffic
   Return Email DNS Check	Enable to perform a DNS lookup on the the reply-to email address and reply-to domain. If the lookup fails, the email is treated as spam.
   Spam Filtering
   IP Address Check	The firewall queries the antispam service to determine if the IP address of the client delivering the email is in the block list. If there is a match, the email is treated as spam.
   URL Check	The firewall submits all URLs that appear in the email body to the antispam service for checking. If a URL exists in the URL block list, the email is treated as spam.
   Detect Phishing URLs in Email	The firewall submits all URL hyperlinks that appear in the email body to the antispam service for checking. If a URL exists in the phishing list, the firewall removes the hyperlink from the message. The URL remains in place, but it is no longer a clickable hyperlink.
   Email Checksum Check	The firewall submits a checksum of each email to the antispam service for checking. If a checksum exists in the checksum block list, the email is treated as spam.
   Spam Submission	Spam submission is a way to inform the antispam service of non-spam messages incorrectly marked as spam. When enabled, the firewall adds a link to the end of every email marked as spam. Click the link to notify the antispam service if an email is marked incorrectly.

5. Click Save.