Managing archived email

You can archive email according to criteria you specify. For details, see “Email archiving workflow” on page 656.

You can view and search archived email through the web UI. You can also download them, forward them to an email address, and use them to train the Bayesian databases.

For more information on Bayesian database training, see “Training the Bayesian databases” on page 645.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read-Write permission to the Others category

For details, see “About administrator account permissions and domains” on page 290.

To view archived email

1. Go to Monitor > Archive > Archive Accounts.
2. Select the email archive account you want to view and click View. For details about email archive accounts, see “Configuring email archiving accounts” on page 656.
3. From the Archive Folder drop-down list, select Inbox to view the good mail mailboxes, or select Bulk to view the spam mailboxes.
4. Double-click the name of the email archive mailbox that you want to view.

A list of archived email appears.

Figure 79:Contents an archive mailbox

To train Bayesian databases with archived mail

1. Go to Monitor > Archive > Archive Accounts.
2. Select the email archive account you want to view and click View. For details about email archive accounts, see “Configuring email archiving accounts” on page 656.
3. From the Archive Folder drop-down list, select Inbox to view the good mail mailboxes, or select Bulk to view the spam mailboxes.
4. Double-click the name of the email archive mailbox that you want to use to train the Bayesian databases.
5. In the check box column, mark the check box of each email that you want to use to train the Bayesian databases. To use all messages for training, select the check box above the first message to mark the check boxes of all email on the current page.
6. Click Train Bayesian Database.

Figure 80: Training a Bayesian database using archived email

7. Select whether to use the messages as spam or non-spam (known as innocent messages) email.
8. Select the database you want to train: global, per-domain (group), or personal.
   • Global requires no further information.
   • For per-domain database training, select the domain.
   • For personal database training, select the domain in Group database, then select the name of the user.
9. Click Apply.

Viewing the endpoint reputation statuses

Go to Monitor > Endpoint Reputation > Auto Blacklist to view the current list of carrier end points (by their MSISDN, subscriber ID, or other identifier) that were caught by FortiMail for sending spam. For general procedures about how to configure endpoint reputation, see “Configuring endpoint reputation” on page 639.

If a carrier end point has attempted to deliver during the automatic blacklisting window a number of spam text messages that is greater than the automatic endpoint blacklisting threshold, FortiMail unit adds the carrier end point to the automatic endpoint black list for the duration configured in the session profile. While the carrier end point is on the automatic black list and it does not expire, all text messages or email messages from it will be rejected. For information on configuring the automatic black list window, see “Configuring the endpoint reputation score window” on page 643. For information on enabling the endpoint reputation scan and configuring the automatic black list threshold in a session profile, see “Configuring session profiles” on page 482.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read or Read-Write permission to the Black/White List category For details, see “About administrator account permissions and domains” on page 290.

To view the automatic endpoint reputation black list, go to Monitor > Endpoint Reputation > Auto Blacklist.

Figure 77:Viewing endpoint reputation scores

Table 18:Auto Blacklist tab

Filtering automatic endpoint black list entries

You can filter automatic endpoint black list entries that appear on the Auto Blacklist tab based on the MSISDN, subscriber ID, or other sender identifier.

To filter the endpoint black list entries

1. Go to Monitor > Endpoint Reputation > Auto Blacklist.
2. Click Search.

Figure 78:A dialog appears.Search Dialog

3. Click Search.

The Auto Blacklist tab appears again, but its contents are restricted to entries that match your filter criteria. To remove the filter criteria and display all entries, click the Auto Blacklist tab to refresh its view.

Viewing the sender reputation statuses

The FortiMail unit tracks SMTP client behavior to limit deliveries of those clients sending excessive spam messages, infected email, or messages to invalid recipients. Should clients continue delivering these types of messages, their connection attempts are temporarily or permanently rejected. Sender reputation is managed by the FortiMail unit and requires no administration.

Monitor > Sender Reputation > Display displays the sender reputation score for each SMTP client.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read-Write permission to the Policy category

For details, see “About administrator account permissions and domains” on page 290.

For more information on enabling sender reputation and configuring the score thresholds, see “Configuring sender reputation options” on page 485.

To view the sender reputation scores, go to Monitor > Sender Reputation > Display.

Figure 75:Display tab

Table 17:Viewing the sender reputation statuses

Sender reputation is a predominantly automatic antispam feature, requiring little or no maintenance. For each connecting SMTP client (sometimes called a sender), the sender reputation feature records the sender IP address and the number of good email and bad email from the sender.

In this case, bad email is defined as:

• Spam
• Virus-infected
• Unknown recipients
• Invalid DKIM
• Failed SPF check

The sender reputation feature calculates the sender’s current reputation score using the ratio of good email to bad email. and performs an action based on that score.

The FortiMail unit calculates the sender reputation score using statistics up to 12 hours old, with more recent statistics influencing the score more than older statistics. The sender reputation score decreases (improves) as time passes where the sender has not sent spam. The score itself ranges from 0 to 100, with 0 representing a completely acceptable sender, and 100 being a totally unacceptable sender.

To determine which action the FortiMail unit will perform after it calculates the sender reputation score, the FortiMail unit compares the score to three score thresholds which you can configure in the session profile:

1. Throttle client at: For scores less than this threshold, senders are allowed to deliver email without restrictions. For scores greater than this threshold but less than the temporary fail threshold, senders are rate-limited in the number of email messages that they can deliver per hour, expressed as either an absolute number or as a percentage of the number sent during the previous hour. If a sender exceeds the limit and keeps sending email, the FortiMail unit will send temporary failure codes to the sender. See descriptions for Temporary fail in “Configuring sender reputation options” on page 485.
2. Temporarily fail: For scores greater than this threshold but less than the reject threshold, the FortiMail unit replies to senders with a temporary failure code, delaying delivery and requiring senders to retry later when their score is reduced.
3. Reject: For scores greater than this threshold, the FortiMail unit replies to senders with a rejection code.

If the SMTP client does not attempt any email deliveries for more than 12 hours, the SMTP client’s sender reputation entry is deleted, and a subsequent delivery attempt is regarded as a new SMTP client by the sender reputation feature.

Filtering sender reputation score entries

You can filter sender reputation score entries that appear on the Display tab based on the IP address of the SMTP client, the score, state, and date/time of the last score modification.

To filter the sender reputation score entries 1. Go to Monitor > Sender Reputation > Display.

2. Click Search.

A dialog appears.

Figure 76:Search dialog

3. Configure one or more of the following:

Blank fields match any value. Regular expressions and wild cards are not supported.

4. Click Search.

The Display tab appears again, but its contents are restricted to entries that match your filter criteria. To remove the filter criteria and display all entries, click the Display tab to refresh its view.

Viewing the greylist statuses

The Greylist submenu lets you monitor automatic greylisting exemptions, and email currently experiencing temporary failure of delivery due to greylisting.

Greylisting exploits the tendency of legitimate email servers to retry email delivery after an initial temporary failure, while spammers will typically abandon further delivery attempts to maximize spam throughput. The greylist scanner replies with a temporary failure for all email messages whose combination of sender email address, recipient email address, and SMTP client IP address is unknown. If an SMTP server retries to send the email message after the required greylist delay but before expiry, the FortiMail unit accepts the email and adds the combination of sender email address, recipient email address, and SMTP client IP address to the list of those known by the greylist scanner. Subsequent known email messages are accepted. For details on the greylisting mechanism, see “About greylisting” on page 624.

To use greylisting, you must enable the greylist scan in the antispam profile. For more information, see “Managing antispam profiles” on page 503.

Greylisting is bypassed if the SMTP client establishes an authenticated session (see “Bypass scan on SMTP authentication” on page 533, “Controlling email based on recipient addresses” on page 468, and “Controlling email based on IP addresses” on page 475), or if the matching access control rule’s Action is RELAY (see “Order of execution” on page 16).

You can configure the initial delay associated with greylisting, and manually exempt senders. For details, see “Configuring the grey list TTL and initial delay” on page 628 and “Manually exempting senders from greylisting” on page 630.

Viewing the pending and individual automatic greylist entries

The Display tab lets you view pending and individual automatic greylist entries.

• Pending greylist entries are those whose Status is not PASSTHROUGH. For email messages matching pending greylist entries, the FortiMail unit will reply to delivery attempts with a temporary failure code until the greylist delay period, indicated by Time to passthrough, has elapsed.
• Individual greylist entries are those whose Status is PASSTHROUGH. For email messages matching pending greylist entries, the greylist scanner will allow the delivery attempt, and may create a consolidated automatic greylist entry. For information on consolidated entries, see “Viewing the consolidated automatic greylist exemptions” on page 196.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read-Write permission to the Policy category

For details, see “About administrator account permissions and domains” on page 290.

To view the greylist, go to Monitor > Greylist > Display.

Figure 73:Display tab

Table 15:Viewing the list of pending and individual greylist entries

Table 15:Viewing the list of pending and individual greylist entries

Filtering pending and individual automatic greylist entries

You can filter the greylist entries on the Display tab based on sender email address, recipient email address, and/or the IP address of the SMTP client.

To filter the greylist entries 1. Go to Monitor > Greylist > Display.

2. Click Search.

A dialog appears.

Figure 74:Search dialog

3. Configure one or more of the following:

Use an asterisk (*) to match multiple patterns, such as typing user* to match user1@example.com, user2@example.net, and so forth. Blank fields match any value.

Regular expressions are not supported.

4. Click Search.

The Display tab appears again, but its contents are restricted to entries that match your filter criteria. To remove the filter criteria and display all entries, click the Display tab to refresh its view.

Viewing the consolidated automatic greylist exemptions

The Auto Exempt tab displays consolidated automatic greylist entries.

The FortiMail unit creates consolidated greylist entries from individual automatic greylist entries that meet consolidation requirements. For more information on individual automatic greylist entries, see “Viewing the pending and individual automatic greylist entries” on page 193. For more information on consolidation requirements, see “Automatic greylist entries” on page 627.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read or Read-Write permission to the Policy category For details, see “About administrator account permissions and domains” on page 290.

To view the list of consolidated entries, go to Monitor > Greylist > Auto Exempt.

Table 16:Auto Exempt tab options

Managing the deferred mail queue

The FortiMail unit prioritizes the mail queue into two types:

• Regular mail queue

When the initial attempt to deliver an email fails, the FortiMail unit moves the email to the regular mail queue.

• Slow mail queue

After another two failed delivery attempts, the FortiMail unit moves the email to the slow mail queue. This allows the FortiMail unit to resend valid email quickly, instead of keep resending invalid email (for example, email destined to an invalid MTA).

After the undelivered email remains in the deferred queue for five minutes, the mail appears under Monitor > Mail Queue > Mail Queue. This also means that email staying in the deferred queue for less than five minutes does not appear on the Mail Queue tab.

Delivery failure can be caused by temporary reasons such as interruptions to network connectivity. FortiMail units will periodically retry delivery. (Administrators can also manually initiate a retry.) If the email is subsequently sent successfully, the FortiMail unit simply removes the email from the queue. It does not notify the sender. But if delivery continues to be deferred, the FortiMail unit eventually sends an initial delivery status notification (DSN) email message to notify the sender that delivery has not yet succeeded. Finally, if the FortiMail unit cannot send the email message by the end of the time limit for delivery retries, the FortiMail unit sends a final DSN to notify the sender about the delivery failure and deletes the email message from the deferred queue. If the sender cannot receive this notification, such as if the sender’s SMTP server is unreachable or if the sender address is invalid or empty, the FortiMail unit will save a copy of the email in the dead mail folder. For more information, see “Managing undeliverable mail” on page 181.

For information on configuring the delivery retry interval, maximum amount of time that an email message can spend in a queue, and DSN timing, see “Configuring mail server settings” on page 366.

When you delete a deferred email, the FortiMail unit sends an email message, with the deleted email attached to it, to notify the sender.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read-Write permission to the Policy category

For details, see “About administrator account permissions and domains” on page 290.

To view, delete, or resend an email in the deferred mail queue, go to Monitor > Mail Queue > Mail Queue.

Table 14:Managing the deferred mail queue

GUI item           Description

View (button)    Select a message and click View to see its contents.

Delete (button) Click to deleted the selected item.

Resend          Mark the check boxes of the rows corresponding to the email messages that you want to immediately retry to send, then click Resend. (button)

To determine if these retries succeeded, click Refresh. If a retry succeeds, the email will no longer appear in either the deferred mail queue or the dead mail folder. Otherwise, the retry has failed.

Table 14:Managing the deferred mail queue

Managing undeliverable mail

The Dead Mail tab displays the list of email messages in the dead mail folder.

Unlike the deferred mail queue, the dead mail folder contains copies of delivery status notification (DSN) email messages, also called non-delivery reports (NDR).

DSN messages are sent from the FortiMail unit (“postmaster”) to an email’s sender when the email is considered to be more permanently undeliverable because all previous retry attempts of the deferred email message have failed. These email messages from “postmaster” include a copy of the original email message for which the DSN was generated.

If an email cannot be sent nor a DSN returned to the sender, it is usually because both the recipient and sender addresses are invalid. Such email messages are often sent by spammers who know the domain name of an SMTP server but not the names of its email users, and are attempting to send spam by guessing at valid recipient email addresses.

The FortiMail unit can automatically delete old dead mail. For details, see “Configuring mail queue setting” on page 370.

Alternatively, you can:

• To prevent dead mail to invalid recipients, enable recipient address verification to reject email with invalid recipients. Rejecting email with invalid recipients also prevents quarantine mailboxes for invalid recipients from consuming hard disk space. For details, see “Configuring recipient address verification” on page 387.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read-Write permission to the Policy category

For details, see “About administrator account permissions and domains” on page 290.

To view or delete undeliverable email, go to Monitor > Mail Queue > Dead Mail.

Monitoring the system

The Monitor menu displays system usage, mail queues, log messages, reports, and other status-indicating items.

It also allows you to manage the contents of the mail queue and quarantines, and the sender reputation and endpoint reputation scores.

This section includes:

• Viewing overall system statuses
• Managing the deferred mail queue
• Managing the quarantines
• Viewing the greylist statuses
• Viewing the sender reputation statuses
• Viewing the endpoint reputation statuses
• Managing archived email
• Viewing log messages
• Viewing generated reports

Viewing overall system statuses

Monitor > System Status displays system statuses, most of which pertain to the entire system, such as CPU usage and current IP sessions. It also displays items that span multiple features, such as email statistics.

This section includes:

• Viewing the dashboard
• Viewing the email statistics
• Viewing the list of current IP sessions

Viewing the dashboard

Monitor > System Status > Status displays first after you log in to the web UI. It contains a dashboard with widgets that each indicate performance level or other statistics.

By default, widgets display the serial number and current system status of the FortiMail unit, including uptime, system resource usage, alert messages, host name, firmware version, system time, and email throughput.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read-Write permission to the Others category

For details, see “About administrator account permissions and domains” on page 290.

To view the dashboard, go to Monitor > System Status > Status.

Page 173

Hiding, showing and moving widgets

The dashboard is customizable. You can select which widgets to display, where they are located on the tab, and whether they are minimized or maximized.

To move a widget, position your mouse cursor on the widget’s title bar, then click and drag the widget to its new location.

To show or hide a widget, in the upper left-hand corner, click Add Content, then mark the check boxes of widgets that you want to show.

Options vary slightly from widget to widget, but always include options to close or minimize/maximize the widget.

System Information widget

The System Information widget displays the serial number and basic system statuses such as the firmware version, system time, and up time and high availability (HA) status.

In addition to displaying basic system information, the System Information widget lets you configure the operation mode and to change the firmware.

To view the widget, go to Monitor > System Status > Status. If the widget is not currently shown, click Add Content, and mark the check box for the widget.

Figure 65:System Information widget

Table 12:System Information widget features

Table 12:System Information widget features

License Information widget

The License Information widget displays the last queried license statuses for FortiGuard Antispam and FortiGuard Antivirus.

If you do not want to allow the FortiMail unit to automatically download antivirus definition updates from the FortiGuard Distribution Network (FDN), you can also use the

License Information widget to manually upload an antivirus definitions update file. To upload the file, first download the antivirus definition file to your management computer from the Fortinet Technical Support web site, https://support.fortinet.com, then click Update.

If your update is a downgrade to a lower antivirus definition, you need to enable this function in the CLI. For more information, see the diag debug autoupdate command in the FortiMail CLI Reference.

Updating FortiGuard Antivirus definitions can cause a short disruption in the traffic currently being scanned while the FortiMail unit applies the new signature database. To minimize disruptions, update when traffic is light, such as during the night.

To view the widget, go to Monitor > System Status > Status. If the widget is not currently shown, click Add Content, and mark the check box for the widget.

Backing up the configuration

Once you have tested your basic installation and verified that it functions correctly, create a backup. This “clean” backup can be used to:

• troubleshoot a non-functional configuration by comparing it with this functional baseline
• rapidly restore your installation to a simple yet working point

The following procedures only produce a backup of the configuration file. If you have also configured other settings such as black/white lists, dictionaries, and the Bayesian databases, you should back them up as well. For information on how to back up other configuration settings and databases, see “Backup and restore” on page 218.

To back up the configuration file via the web UI

1. Log in to the web UI as the admin

Other administrator accounts do not have the required permissions.

2. Go to Maintenance > System > Configuraton in the advanced mode.
3. In the Backup Configuration area, select Local PC.
4. Select System Configuration (and User Configuration if you have already configured user preferences).
5. Click Backup.

If your browser prompts you, navigate to the folder where you want to save the configuration file. Click Save.

Your browser downloads the configuration file. Time required varies by the size of the configuration and the specifications of the appliance’s hardware as well as the speed of your network connection.

To back up the configuration file via the CLI

1. Log in to the CLI as the admin administrator using either the local serial console, the CLI Console widget in the web UI, or an SSH or Telnet connection.

Other administrator accounts do not have the required permissions.

2. Enter the following command:

execute backup full-config tftp <file-name_str> <server_ipv4> [<backup-password_str>]

where the variables and options are as follows:

Variable                        Description

<file-name_str>     Type the file name of the backup.

<server_ipv4>      Type the IP address or domain name of the server.

[<backup-password_s Optional. Type the password that will be used to encrypt the tr>]  backup file.

Caution: Do not lose this password. You will need to enter this same password when restoring the backup file in order for the appliance to successfully decrypt the file. If you cannot remember the password, the backup cannot be used.

For example, the following command backs up a FortiMail-3000C’s configuration file to a file named FortiMail-3000C.conf in the current directory on the TFTP server 172.16.1.10, encrypting the backup file using the password P@ssw0rd1:

FortiMail-3000C # execute backup full-config tftp

FortiMail-3000c.conf 172.16.1.10 P@ssw0rd1

Time required varies by the size of the database and the specifications of the appliance’s hardware, but could take several minutes.

Testing the installation

After completing the installation, test it by sending email between legitimate SMTP clients and servers at various points within your network topology.

If the FortiMail unit is operating in gateway mode or transparent mode, you may also wish to test access of email users to their per-recipient quarantined email.

If the FortiMail unit is operating in server mode, you may also wish to test access to FortiMail webmail, POP3, and/or IMAP.

Figure 59:Connection test paths (gateway mode)

Private                                                                                                       Public DNS Server

Gateway Mode

DNS Server

Figure 60:Connection test paths (transparent mode)

Figure 61:Connection test paths (server mode)

To verify all SMTP connections to and from your FortiMail unit, consider both internal and external recipient email addresses, as well as all possible internal and external SMTP clients and servers that will interact with your FortiMail unit, and send email messages that test the connections both to and from each of those clients and servers. For example:

1. Using an SMTP client on the local network whose MTA is the FortiMail unit or protected email server, send an email from an internal sender to an internal
2. Using an SMTP client on the local network whose MTA is the FortiMail unit or protected email server, send an email from an internal sender to an external
3. Send an email from an external sender to an internal
4. If you have remote SMTP clients such as mobile users or branch office SMTP servers, using an SMTP client on the remote network whose MTA is the FortiMail unit or protected email server, send an email from an internal sender to an internal
5. If you have remote SMTP clients such as mobile users or branch office SMTP servers, using an SMTP client on the remote network whose MTA is the FortiMail unit or protected email server, send an email from an internal sender to an external

If you cannot connect, receive error messages while establishing the connection, or the recipient does not receive the email message, verify your configuration, especially:

• routing and policy configuration of intermediary NAT devices such as firewalls or routers
• connectivity of the FortiMail unit with the Fortinet Distribution Network (FDN)
• external email servers’ connectivity with and the configuration of the public DNS server that hosts the MX records, A records, and reverse DNS records for your domain names
• the FortiMail unit’s connectivity with and the configuration of the local private DNS server (if any) that caches records for external domain names and, if the Use MX record option is enabled, hosts private MX records that refer to your protected email servers
• access control rules on your FortiMail unit
• configuration of MUAs, including the IP address/domain name of the SMTP and POP3/IMAP server, authentication, and encryption (such as SSL or TLS)

For information on tools that you can use to troubleshoot, see “Troubleshooting tools” on page 161.