New Member

Question

Header From field check

Forum|Forum|7 years ago
July 11, 2018
4 replies
23088 views

Hello,

Since some time, I have more spam where From SMTP address is different from Header From address.

In MS Outlook Header From is displayed; this address is used to steal identity.

Can I configure Fortimail in order to also check Header From address?

Thank you

(Fortimail 5.4.x)

FortiMail

Dirty_Wizard_FTNT

Staff

Check header From against what?

You can set FortiMail to check the header From email domain against SPF:

config antispam settings

set spf-checking strict-anti-spoofing end

Page 44: https://docs.fortinet.com/uploaded/files/4495/fortimail-cli-reference-546.pdf

Is the header From email spoofed as your own domain?

Carl_Windsor_FTNT

Staff

If the spam is spoofing the protected domain, you can use the 6.0 Impersonation detection feature.

In the next major release we will be separating the header alignment check from the spf-checking strict-anti-spoofing setting to allow more flexibility in configuration - although blocking all lack of alignment will generate false positives so it is recommended to tag the subject/top of email rather than block.

Hosemacht

Explorer

you can use the dictonary filter to set a regular expression for the header:

[EHeAdEr]^from:.*\b\@example.com\b

Change "@example.com" to your Domain name

set "Search Header" enabled and add it to your antispam profile.

Hosemacht

Explorer

i would highly recommend not to use whitelistening based on a Header From Field.

Every email matches this header will get through without an AS check.

Furthermore i guess its not possible at the moment with a FortiMail.

Regards

live89

Explorer III

I think this is what you're lookiing for

https://kb.fortinet.com/k....do?externalID=FD45736

Novox

New Member

Hi, I'm trying to use:

[EHeAdEr]^From:.*\b\@domain.com\b

However, shouldn't the period before .com be preceded with \ so that \. matches literally "." Otherwise it's matching any char (which is also fine, since "." will match "period").

My confusion is in the "[EHeAdEr]" part...

As far as I understand RegEx's, this means choose ONE of the following literal characters E, H, e, A, d, E, r. And I don't know why this would be necessary because ^ means "beginning of line or string"

Also, should there be a /i at the end for "case-insensitive"?

Previously, I had:

/^from:.*\bdomain\.com\b/i

which was causing issues?! (matching things it should never match).

Thank you!

Jeff_Roback

New Member

I don't know why support keeps giving out this Regex string. As pointed out above, it has two problems:

1) The . in domain.com is evaluated as matching any character since it's not escaped.

2) The [EHeAdEr] isn't helping since a match of any of those characters will work.

This string seems to have originated from this post: https://forum.fortinet.com/tm.aspx?m=190591&high=fortimail+spf but I'm not entirely if it was a typo from the author or a misunderstanding,

In any event, it's a bit troubling that support keeps giving this out.

Here's what we've been testing with:

^From:.*<.*\@mydomain\.com>$

Here's a really handy site that lets you put in a regex string and test it against text. It will also break down the command for you.

https://regexr.com/