fortimail fail to receive email with URLs, got UriExpander and MediaException error.

Jackchenwork · ‎04-20-2022

Hi ,

I am wondering if anyone with Fortimail instance can help to confirm if you have same problem as our fortimail.

We just found if a incoming email has more than 1 particular urls, it will go nuts.

Here are two example urls:

https://www.google.com/url?q=https://docs.tenable.com&source=gmail-html&ust=1
https://www.google.com/url?q=https://docs.tenable.com&source=gmail-html&ust=2

As soon as I added the two urls in incoming email ( from gmail or from Exchange Online), Fortimail will fail to receive the email.

I have opened a support ticket with Fortinet, but the response is very slow. I am wondering if any Fortimail user can reproduce the issue.

There are many urls can trigger the UriExpander error, examples:

UriExpander: Broken pipe while connecting to https://t.co/bAMtodzfGI
UriExpander: Broken pipe while connecting to https://goo.gl/maps/VI3i1

jpretli2 · ‎04-22-2022

Hi Jackchenwork,

please have a look at the Firewall Policies for your FortiMail and also check your Logfiles.

It is common that FortiMail is allowed to connect to our update- and FortiGuard- Servers to download updates and do some URL rating lookups. But it is also part of good security policies to block all other traffic which is not necessary. I assume that your FortiMail is not allowed to connect to the rest of the internet using http and https just to prevent any XSS and other hacking attempts.

How URL rating works in FortiMail is divided into 2 parts:

(1) all incoming URL are checked against FortiGuard Webfilter database - this seems to work ok in your setup.

(2) URL shortener or redirects cannot be checked in step (1) as at this stage it is only the redirect service. So we need to know to what site the redirect is pointing to. To achieve this the FortiMail URI-Expander you're seeing in your logfile tries to follow the redirect to the URL it is pointing to. Once the destination is known this URL will also be checked using FortiGuard Webilter database for a correct URL rating.

So it is essential that FortiMail can communicate to the internet world.

Please check your log files for blocked attempts and also check your policies.

regards

jochen

View solution in original post

nillwatson532 · ‎04-22-2022

I am wondering if anyone with a Fortimail instance can help to confirm if you have the same problem as our fortimail. We just found if an incoming email has more than 1 particular URL, it will go nuts.

As soon as I added the two URLs in the incoming email ( from Gmail or from Exchange Online), Fortimail will fail to receive the email.

I have opened a support ticket with Fortinet, but the response is very slow. I am wondering if any Fortimail user can reproduce the issue.

https://www.hiloindustrial.com/