ASE blocking legitimate emails regularly

[#1]

Just lately a lot of legitimate emails seem to be being blocked via our Fortigate 100A running the latest Firmware, has anyone else seen this? Also we are getting more actual spam through which at the moment is not my main problem due to legitmate emails being blocked from clients. Everyone is saying to move onto FortiMail but this is not an option at the moment so is there anything I can do to stop these legitimate emails being blocked? An example of the emails that are being blocked are as follows " Hi Jennifer I have attached our latest backup for you, please can you confirm all is o.k with attached for you to do below? Thanks Karen From: Sent: 10 June 2009 12:48 To: Subject: 2009 P11Ds Karen As discussed please could you print off the sage nominal codes for the year 6 April 2008 to 5 April 2009; codes from 7000 onwards. Sarah was able to do this for me last year as she must have had a back up; if you have any trouble getting this report please feel free to contact Sarah or send her the latest back up. Best regards Jennifer Thursfield"

[abelio]

Chris, you have to enable AS logging and search within those logs why that email triggered the AS filter settings. Maybe sender IP is blacklisted, etc, many possible causes

[#3]

Also, if you dont see headers inside the emai from " ASE REPORTS" its possible for " Dns return check" , because in too many domains can not resolve the return dns (I dont know why happend), uncheck this option, and ty again. regards from spain

[#4]

I am experiencing the same situation - our log only says " email is reported as spam by ASE" . How do I configure the AS logging to provide details about why the email was reported as spam? Thanks, Bill James

[#5]

Hi Bill We are in the same boat with this. Since updating to the latest OS for our Fortigate we have had this exact message going out to people. I am currently dealing with the tech support folks on this and hopefully with an update or something they can change what is being sent out to the end users. It is very hard to trouble shoot something when you have no information. Jeff

[#6]

Thanks Jeff. What you say makes sense, as our issues began when I updated to the latest software (v4.0 build 0178) last Friday. I am curious if rolling back to the previous version would fix it until the next software release. Anyway, I would appreciate any information you can send along, once you have figured it out with the folks from support. Bill James

[#7]

Well, putting our 100A back to build 106 has solved the problem. Interestingly enough, a few other things (like fully displaying the mainenance pages of the configuration) also seemed to be going wrong. I' m guessing build 178 has issues. Bill James

[gagandeeps]

https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/873628/helo-dns-lookup

By default, HELO DNS and return email DNS checks are done before the block/allow list check. In some situations, such as when configuring a block/allow list to clear an email from performing further filtering, configure the following to give precedence to the block/allow list: config emailfilter profile edit <name> config smtp set local-override enable next end end