Need Help with FortiMail and Mail Server Configuration

I'm currently setting up an email infrastructure with FortiMail acting as our gateway, and I could use some guidance to refine my configuration for better security and functionality. Here's a brief overview of my setup and the issues I'm facing:

Setup Overview:

• No private DNS server or LDAP.

• Backend testing with CWP (Postfix, Dovecot, Roundcube + Outlook, Thunderbird as mail client).

• Two domains to manage.

• SMTP authentication created on the same mail server.

• FortiMail in gateway mode with a DNAT VIP redirecting mail.

• Can send and receive emails inbound and outbound.

Issues:

1. Firewall Policies:

   • I need help configuring firewall policies to ensure that SMTPS and HTTPS traffic goes to FortiMail, while IMAP, POP3S, and other services (webmail, etc.) go to the backend mail server.

   • I have only one public IP, so any recommendations for port forwarding at FortiGate to manage services better would be appreciated.

2. SMTP Authentication and Relay:

   • I want to use the SMTP authentication created on the same mail server as FortiMail.

   • The auth proxy cannot save mailboxes in gateway mode, so I need to ensure successful authentication.

3. FortiMail Policies:

   • I prefer IP-based access control for now.

   • My main objectives are anti-spam, antivirus, CDR, and DLP.

My Questions:

• How can I make my firewall policies specific so that SMTPS and HTTPS traffic goes to FortiMail, and other services go to the backend mail server?

• What are the best practices for authentication and general FortiMail policies, especially for anti-spam, antivirus, CDR, and DLP?

I've configured the mailserver host file, set the domain as relay as host, and set the mail server settings in FortiMail. However, I'm still facing challenges with traffic routing and authentication.Any advice or recommendations from your experiences would be greatly appreciated. Thank you in advance for your help!