Troubleshooting Tip: FortiMail displays error: 'FortiGuard-Antispam: Query timeout or invalid response' and FortiGuard-Antispam: No Answer from server.

Description

This article describes the causes of the Error: 'FortiGuard-Antispam: Query timeout or invalid response' and FortiGuard-Antispam: No Answer from server error typically indicates an issue with connectivity or configuration.

Scope

FortiMail.

Solution

Check DNS Configuration:

It is necessary to validate the correct resolution of names in FortiMail. Use the following commands to confirm the DNS resolution:

execute nslookup name www.fortinet.com

Verify FortiGuard License: 

It is necessary to validate that the license is valid and active.

Via GUI: Go to System -> FortiGuard.

Or validate the license via the CLI:

diagnose debug rating

Network connectivity: 

Confirm that the FortiMail has internet access and can reach FortiGuard for license validation. FortiMail uses the following URLs to access the FortiGuard Distribution Network (FDN):

• update.fortiguard.net

• support.fortinet.com

• service.fortiguard.net (global) or usservice.fortiguard.net (United States only).

• securewf.fortiguard.net (global) or ussecurewf.fortiguard.net (United States only).

Furthermore, FortiMail performs these queries and updates listed below using the following ports and protocols:

• FortiGuard Anti-Spam rating queries: UDP/53, TCP/53, TCP/8888, UDP/8888, TCP/443, 8889.

• FortiGuard AntiVirus Push updates: UDP/9443.

• FortiGuard Anti-Spam or AntiVirus updates: TCP/443.

Use the following commands to confirm the DNS resolution and communicate with the FortiGuard servers:

execute nslookup name update.fortiguard.net
execute telnettest service.fortiguard.net:443

Example with communication problems to FortiGuard but no issues with name resolution.

Example without communication errors:

After resolving the communication issues, FortiGuard's response is correct.

Result: