Configuring FortiGuard options

The FortiGuard section of antispam profiles lets you configure the FortiMail unit to query the FortiGuard Antispam service to check the following:

• Back IP: If you enable the Black IP option, the FortiMail unit will query the FortiGuard Antispam service to determine if the IP address of the current SMTP client is blacklisted. If the Black IP option located in the Deep header section is enabled, the FortiGuard scan will also examine the IP addresses of all other SMTP servers that appear in the Received: lines of the message header. For more information, see “Configuring deep header options” on page 508.

FortiGuard Antispam scans do not examine private network addresses, as defined in RFC 1918.

• URI filter: this option determines if any uniform resource identifiers (URI) in the message body are associated with spam. FortiGuard URI filter groups URI into various categories, such as hacking, drug abuse and so on. You can configure the FortiGuard URI filter to check for certain categories only. For details, see “Configuring a FortiGuard URI filter profile” on page 507. If a URI is blacklisted, the FortiMail unit treats the email as spam and performs the associated action.

Before enabling FortiGuard, you must enable and configure FortiGuard Antispam rating queries. For more information, see “Verifying connectivity with FortiGuard services” on page 237.

If the FortiGuard option is enabled, you may improve performance and the spam catch rate by also enabling Black IP and caching. For details on enabling caching, see ““Configuring FortiGuard updates and antispam queries” on page 233.

To configure FortiGuard scan options

1. When configuring an antispam profile, select the FortiGuard check box in the AntiSpam Profile
2. From Action, select the action profile that you want the FortiMail unit to use if the FortiGuard Antispam scan finds spam email.

For more information, see “Configuring antispam action profiles” on page 516.

3. If you want the FortiMail unit to query the FortiGuard Antispam service to determine if the IP address of the SMTP server is blacklisted, enable Black IP.

Whether the FortiMail unit queries for the blacklist status of the IP address of only the most recent SMTP server or of all SMTP servers in the Received: lines of the message header varies by the configuration of Deep header. For more information, see “Configuring deep header options” on page 508.

4. If you want to use the FortiGuard URI filter service, select a filter profile from the URI filter For details, see “Configuring a FortiGuard URI filter profile” on page 507.
5. From Action, select the action profile that you want the FortiMail unit to use if the FortiGuard Antispam scan finds spam email.
6. Continue to the next section, or click Create or OK to save the antispam profile.

Configuring a FortiGuard URI filter profile

FortiGuard URI filter service allows you choose which categories of URI in the email body you want to check and block. Then you can use the filters in the antispam profiles. For details, see “Configuring FortiGuard options” on page 506.

To configure a URI filter profile 1. Go to Profile > AntiSpam > URI Filter.

2. Click Create New.
3. Enter a profile name.
4. Select the URI categories you want to check in the email body.
5. Click Create.

URI types

There are two types of URIs:

• Absolute URIs strictly follow the URI syntax and include the URI scheme names, such as “http”, “https”, and “ftp”. For instance, http://www.example.com.
• Reference URIs do not contain the scheme names. For instance, example.com.

By default, FortiMail scans for both absolute and reference URIs.

In some cases (for example, to lower false positive rates), you may want to scan for absolute URIs only. To do this, you can use the following CLI command to change the default setting:

config antispam settings

set uri-checking {aggressive | strict}

end

• aggressive: Choose this option to scan for both the absolute and reference URIs.
• strict: Choose this option to scan for absolute URIs only. Note that web sites without

“http” or “https” but starting with “www” are also treated as absolute URIs. For instance, www.example.com.

For more information about this command, see FortiMail CLI Reference.

Configuring DNSBL options

In addition to supporting Fortinet’s FortiGuard Antispam DNSBL service, the FortiMail unit supports third-party DNS blacklist servers. You can enable DNSBL filtering as part of the antispam profile, and define multiple DNSBL servers for each antispam profile. Consult the third-party DNSBL service providers for any conditions and restrictions.

DNSBL scans examine the IP address of the SMTP client that is currently delivering the email message. If the Enable Black IP to query for the blacklist status of the IP addresses of all SMTP servers appearing in the Received: lines of header lines. option located in the Deep header section is enabled, DNSBL scan will also examine the IP addresses of all other SMTP servers that appear in the Received: lines of the message header. For more information, see ““Configuring deep header options” on page 508.

DNSBL scans do not examine private network addresses, which are defined in RFC 1918.

The DNSBL section of antispam profiles lets you configure the FortiMail unit to query one or more DNS black list (DNSBL) servers to determine if the IP address of the SMTP client has been blacklisted. If the IP address is blacklisted, the FortiMail unit treats the email as spam and performs the associated action.

To configure DNSBL scan options

1. When configuring an antispam profile, enable DNSBL in the AntiSpam Profile
2. From Action, select the action profile that you want the FortiMail unit to use if the DNSBL scan finds spam email.

For more information, see “Configuring antispam action profiles” on page 516.

3. Next to DNSBL click Configuration.

A pop-up window appears where you can enter the domain names of DNSBL servers to use with this profile.

4. To add a new DNSBL server address, click New and type the address in the field that appears.

Since the servers are queried from top to bottom, you may want to put the reliable servers with less traffic to the top of the list. Click the drop-down menu in the title bar to sort the entries.

5. Select a server from the list and click OK.

The pop-up window closes.

Closing the pop-up window does not save the antispam profile and its associated DNSBL server list. To save changes to the DNSBL server list, in the antispam profile, click OK before navigating away to another part of the web UI.

6. Continue to the next section, or click Create or OK to save the antispam profile.