Skip to main content
NeoRant
NeoRant
Explorer III
May 10, 2024
Solved

Fortimail False positives

  • May 10, 2024
  • 3 replies
  • 5897 views

Hi Guys, 

 

I am grateful for this community, some great teachers here, I am learning alot about Fortimail and have done some good work so far.

 

I have now fully integrated my fortimail in the DMZ, the fortigate fwl, getting smtp traffic, inspection of smtp traffic actually WORKING, thank God.

 

However, one problem lol. ALOT of false positives and people are squealing. I used the full inspection rules instructed by guide below - antispam, antivirus, content etc and I tell you mails are being inspected hard.

https://ebin.pub/fortinet-fortimail-lab-guide-for-fortimail-72.html

 

Can anyone here post me a good setup for traffic inspection (not so robust/sensitive)?

 

I am currently using the recipient policy as that is what was selected by my team. I was the one that configured the fortimail from scratch and deployed it(with the help/knowledge of you guys of course).

Best answer by AEK

Hi NeoRant

Congratulations for your first prod FML integration. The first is the harder, and the following ones will be fast and easy.

You can share your false positives and we will try help.

But the good method is first to know the order of execution:

https://docs.fortinet.com/document/fortimail/7.4.2/administration-guide/521188/how-fortimail-processes-email#overview_540178514_2524484

Keep that table next to you when you try resolve false positive issues. For example you will understand that if a legitimate mail was blocked due to IP reputation then safe-listing will not help, as the IP reputation is checked before the safe-listing.

3 replies

AEK
SuperUser
AEKAnswer
SuperUser
May 11, 2024

Hi NeoRant

Congratulations for your first prod FML integration. The first is the harder, and the following ones will be fast and easy.

You can share your false positives and we will try help.

But the good method is first to know the order of execution:

https://docs.fortinet.com/document/fortimail/7.4.2/administration-guide/521188/how-fortimail-processes-email#overview_540178514_2524484

Keep that table next to you when you try resolve false positive issues. For example you will understand that if a legitimate mail was blocked due to IP reputation then safe-listing will not help, as the IP reputation is checked before the safe-listing.

AEK
NeoRant
NeoRantAuthor
Explorer III
May 11, 2024

Hi AEK,

 

Thank you for this, i will review and provide update.

 

Regards,

AEK
SuperUser
AEK
SuperUser
May 12, 2024

Additionally regarding your false positives, usually it is due to a hard AntiSpam profile, so I'm sharing here an AS profile that I usually setup as the main inbound profile.

as1.png

as2.png

Hope it helps.

AEK
NeoRant
NeoRantAuthor
Explorer III
May 12, 2024

Hi AEK, 

 

Thank you very much. I will work in this and let you know soon. Cool stuff.

 

Regards

Cajuntank
Cajuntank
Contributor III
May 13, 2024

One thing I'd like to say that was my initial cause of a lot of false positives were the amount of DNSBL sites I had added from seeing some examples online from various places (i.e... YouTube, Reddit, etc...).  I had 10 sites defined and all of my headache was due to that. I scaled mine down to like 2 and now I very rarely encounter a false positive while my catch rate for legit spam is very high.

AEK
SuperUser
AEK
SuperUser
May 13, 2024

@Cajuntank, I never used DNSBL as in my experience FortiGuard (IP Reputation) is best quality and gives much less false positives.

AEK
    Cajuntank
    Cajuntank
    Contributor III
    May 13, 2024

    I get that. My thought process on the matter; with the short amount of time I have had the product in production mind you, is I feel better knowing I am not "putting all of my eggs in one basket" for that determination balanced with not going overboard with that logic.

    Terms & ConditionsAccessibility statement