Description
This article describes that in some cases there is a device in front of a FortiMail which is forwarding all emails to the FortiMail.
If so, there will be issues with SPF checks, since any domain with a hard fail (-all) in their SPF/TXT record will fail since the IP of the incoming device is not in their SPF/TXT records.
Scope
FortiMail.
Solution
It is possible to overcome that either by disabling SPF checking, safelisting trusted domains, creating a recipient policy for trusted domains with an antispam policy with SPF checking disabled, or adding the IP/mask of the previous MTA as trusted IP using the below CLI commands:
