Troubleshooting Tip: How to troubleshoot FortiSandbox URL submission exemption in FortiMail

1. Check the CrossSearch log for 'FortiSandbox URL submission exemption':

2. Check FortiMail configurations:

set bypass-one-time-URL enable  <----- It is enabled by default.

3. Change it to 'Disable' to stop the automatically exempt common one-time URLs, such as password reset URLs, from FortiSandbox scanning:

config system fortisandbox
  set bypass-one-time-URL disable
end

This setting can be managed in the GUI under System -> FortiSandbox -> FortiSandbox

Expand URL Scan Setting: