Solution | Spam email has been received from a spoofed IP address that is not in the SPF list for the related domain.Â
In FortiMail configuration, SPF check is enabled and the related action is set to 'Discard':
 
However, the email is not discarded and it is passed with the 'Modify Subject;Quarantine;Insert Disclaimer' action.
This action corresponds to the default action defined in the above antispam profile, named 'User Quarantine':
 
Default actions are overridden when a different action is specified on a technique-by-technique basis.
To troubleshoot why SPF-specific actions are not applied, check:
If DKIM and DMARK scan configuration options are also enabled:
When DMARK is enabled, it performs email authentication with SPF and DKIM.Â
If either the SPF or DKIM verification succeeds, then DMARC verification succeeds.
If both of them fail, then DMARC verification fails.
About the action, for SPF and DKIM, the 'Discard' action has been configured, but for DMARK, the configured action is 'Reject', and this action 'wins' against the other two.
Check cross-search logs, according to Technical Tip: How to effectively archive cross-search logs, for detecting which anispam check is triggering the action. In this example, the log search shows 'FortiGuard AntiSpam' as a classifier and 'Modify Subject;Quarantine;Insert Disclaimer' as an action.Â
Check classifier action in the Scan configuration in the AntiSpam profile. In this example:
  Check this document: How FortiMail processes email. When one of the antispam checks is triggered, FortiMail performs the associated action and skips the remaining antispam checks. In this case, the 'FortiGuard AntiSpam' check is done before the DMARK (SPF and DKIM) check.Â
In conclusion, the SPF check fails, but it is correct that FortiMail does not apply the related action.Â
Related documents: |
