Troubleshooting Tip: Alert email send status failed shows in system event logs when user trying to send FortiToken activation code

[tpatel]

Description	This article describes how to resolve the issue when the user is not getting the activation code of FortiToken through email and sees an 'alert email sending status failed' in system event logs.
Scope	FortiGate.
Solution	After sending the FortiToken activation code through email, in the system event it shows the Log Description as 'Alert email send status failed' and the user is not getting any activation code. Check email server configuration:  config system email-server     set server "fortinet-notifications.com"     set port 465     set security smtps end Make sure FortiGate can resolve fortinet-notifications.com when trying to ping. If not check DNS configuration and DNS server reachability. Run email alert debug and also sniffer for port 465 which is used in email server configuration. Email alert debug with output.  diagnose debug reset diagnose debug enable diagnose debug console timestamp enable diagnose debug application alertmail -1 Error in the debug output. connecting to 208.91.114.151 port 465   --------> Email server IP address. failed to connect session_io_event: creating ssl structure for session 0x95ada40 create_ssl: 0x7f79f9e000 error in SSL_connect (null) _session_on_destroy <== send mail failed, m = 0x9574c70 s = 0x95ada40 failed to connect Run sniffer in another CLI window. diagnose sniffer packet any " host 208.91.114.151 and port 465 " 4 0 l interfaces=[any] filters=[ host 208.91.114.151 and port 465 ] 2025-03-13 00:12:27.902250 tunnel out 10.10.10.1.22652 -> 208.91.114.151.465: syn 3808799857 2025-03-13 00:12:29.512246 tunnel out 10.10.10.1.22651 -> 208.91.114.151.465: syn 1821275767 2025-03-13 00:12:29.902249 tunnel out 10.10.10.1.22652 -> 208.91.114.151.465: syn 3808799857 Traffic is going over the IPsec tunnel because the IPsec tunnel and WAN interface are part of the same SD-WAN zone with the same default route. Not seen any response back to the syn packet over the IPsec tunnel. config system email-server     set server "fortinet-notifications.com"     set port 465     set security smtps     set source-ip x.x.x.x <----- Specify WAN interface IP address. end After specifying the source IP in configuration check traffic in sniffer and traffic for the email server goes over the WAN interface and also the 3-way handshake getting completed.  Related document: Technical Tip: Unable to send FortiToken email using custom SMTP server starting v7.4.4