Skip to main content
AEK
SuperUser
SuperUser
June 11, 2025
Question

Can FortiMail send e-mail body to FortiGuard?

  • June 11, 2025
  • 4 replies
  • 1467 views

Hi FML experts

I know that FML sends some attachments for scan to cloud Sandboxing. I also know that some FML features may send embedded links, source IP, e-mail hashes, but not mail body, to FortiGuard to compare with FortiGuard DNSBL, SURBL and spam DBs.

But is there any option in FortiMail antispam (or other profile) that requires from FML to send the email body to FortiGuard for scan?

4 replies

Jean-Philippe_P
Staff & Editor
Staff & Editor
June 15, 2025

Hello AEK!, 

 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

 

Thanks, 

Jean-Philippe - Fortinet Community Team
AEK
SuperUser
AEKAuthor
SuperUser
June 15, 2025

Thank you Jean!

AEK
Jean-Philippe_P
Staff & Editor
Staff & Editor
June 16, 2025

Hello,

 

We are still looking for an answer to your question.

 

We will come back to you ASAP.

 

Thanks,

Jean-Philippe - Fortinet Community Team
Jean-Philippe_P
Staff & Editor
Staff & Editor
June 17, 2025

Hello again AEK :)

 

I found this solution with a GPT engine, can you tell me if it helps, please?

 

In FortiMail, the standard operation for antispam and other security features typically does not involve sending the entire email body to FortiGuard for scanning. Instead, FortiMail focuses on analyzing metadata, such as embedded links, source IP addresses, and email hashes, to determine the legitimacy of the email.

While FortiMail does use cloud-based services for scanning certain attachments through sandboxing, sending the complete email body for scanning is not a standard feature due to privacy and security considerations. The system is designed to maintain user confidentiality while still providing effective spam and threat detection.

If you're looking for specific configurations or advanced features, it's always a good idea to consult the official FortiMail documentation or reach out to Fortinet support for detailed guidance tailored to your deployment. If you have further questions about FortiMail configurations or features, feel free to ask!

Jean-Philippe - Fortinet Community Team
AEK
SuperUser
AEKAuthor
SuperUser
June 25, 2025

Hi Jean

Sorry for the late response.

Certainly it sounds logic that the mail content is not sent to FortiGuard (or to other location), however I believe GPT can't provide a 100% verified answer in such case, as long as it is not officially published by Fortinet.

AEK
filiaks1
Explorer III
June 30, 2025

Why do you want to send the email in first place to Fortguard is the question?

 

Usually files are send to FortiSandbox on-prem/cloud and FortiNDR as well. 

 

The mail text scanning is done on-prem with DLP , Content profile and SPAM that still could pull Threat intelligence from FortiGuard.  

 

Other than that the urls in the message could be subject to check with fortigard database:

 

Configuring URL filter profiles | FortiMail Appliances and Virtual Machines 7.6.3 | Fortinet Document Library

AEK
SuperUser
AEKAuthor
SuperUser
July 5, 2025

Thanks filiaks

This is indeed logical. However I just need something official, if it exists.

AEK