Technical Tip: How to perform SPF, DKIM, and DMARC Antispam checks even if the sender is included in a safe list

• Execute the commands that would make SPF, DKIM, and DMARC Antispam checks take precedence even if the sender is included in a safe list, as below:

config antispam settings
    set safelist-bypass-sender-auth disable
end

By default, 'safelist-bypass-sender-auth' is set to 'enable', which means that safe-listed senders will bypass all antispam checks.
An example where 'safelist-bypass-sender-auth' is set to 'enable' while the DKIM check fails:

An example where 'safelist-bypass-sender-auth' is set to 'disable' while the DKIM check fails:

Note:

If the 'DNS record policy' is enabled under DMARC in the "Antispam profile", FortiMail will look up the published DMARC record of the domain first  (p=none, p=quarantine, p=reject).

The FortiMail bypasses the SPF evaluation path in this case; however, the command 'set safelist-bypass-sender-auth disable' is executed, since the DMARC check logic took precedence.