Technical Note: Restrict sending emails to an alias email account
Description
Scope
Solution
This article explains how to restrict the sending of emails to an alias email ID (For example: all@example.lab).
Only specific users should be allowed to send the emails to all@example.lab, if any other users send email to this alias email ID, they should be rejected/denied.
For example:
Only specific users should be allowed to send the emails to all@example.lab, if any other users send email to this alias email ID, they should be rejected/denied.
For example:
On FortiMail (in server mode) example.lab is configured as protected domain.
Configured some users, and created a alias user email id as all@example.lab and moved all the users to this.
Only specific users should send the emails to alias email id, and the rest should not.
Scope
FortiMail in server mode.
Solution
Create email-address group
Create Access control receiving policy
Sending an email from exam2@example.lab using an email client (Thunderbird or MS Outlook) should result in the emails being passed and delivered to all users in the alias account.
From the above log traffic can be seen hitting Access Control policy 3.
If an email is sent from other than exam2@example.lab or exam4@example.lab users, the result will be an 'Access Control Denied' message.
From the above logs traffic is seen to match on Access Control policy 2 and Disposition is 'Reject'.
config profile email-address-group
edit restricted
config member
edit exam2@example.lab
next
edit exam3@example.lab
next
end
next
end
Create Access control receiving policy
config policy access-control receive
edit 1
set sender-pattern <int>
set authenticated not-authenticated
next
edit 3
set sender-pattern-type group
set sender-pattern-group restricted
set recipient-pattern all@example.lab
set authenticated authenticated
set action relay
next
edit 2
set sender-pattern <int>
set recipient-pattern all@example.lab
next
end
Sending an email from exam2@example.lab using an email client (Thunderbird or MS Outlook) should result in the emails being passed and delivered to all users in the alias account.
Column Content
Log Type History
Date 2016-12-13
Time 23:12:38
Classifier Not Spam
Disposition Accept
From exam2@example.lab
To exam1@example.lab
Subject testing for alias
Session ID uBE7CbfJ008378-uBE7CbfK008378
Client [10.5.25.24]
Level information
Type statistics
Destination IP 10.5.25.42
Length 380
Resolved FAIL
Mailer mta
Direction in
Policy IDs 3:1:3
Domain example.lab
Log ID 0200008379
From the above log traffic can be seen hitting Access Control policy 3.
If an email is sent from other than exam2@example.lab or exam4@example.lab users, the result will be an 'Access Control Denied' message.
Column Content
Log Type History
Date 2016-12-13
Time 23:11:44
Classifier Access Control-Reject
Disposition Reject
From exam1@example.lab
To all@example.lab
Session ID uBE7BbIt008374-uBE7BbIu008374
Client [10.5.25.24]
Level information
Type statistics
Destination IP 10.5.25.42
Length 394
Resolved FAIL
Mailer mta
Direction in
Policy IDs 2:1:0
Domain example.lab
Log ID 0200008375
From the above logs traffic is seen to match on Access Control policy 2 and Disposition is 'Reject'.