FortiGate: Email Filter "Mark as reject" cannot be selected

[nk22]

FortiGate 200F v7.2.7:

Security Profiles -> Email Filter -> [Local Spam Filtering] Block/Allow List

Hello, I am new to the Fortigate world and currently struggling with creating a local blacklist to block email addresses. Unfortunately, I can only select 'Mark as Spam' and 'Mark as Clear' options. 'Mark as Reject' cannot be chosen. I would appreciate any assistance. 

'Mark as Reject' can only be selected for the following types: 'IP/Netmask' and 'IPv6/Netmask' - which, however, is not suitable for my use case.

[AEK]

There is no "reject" for Sender Address type, even from CLI. You can only select "spam" or "clear".

This makes sens because "reject" is intended to reject the connecting "IP address" once it tries to connect (if I'm not wrong), and this mechanism is at IP level.

[nk22]

Thank you for your valuable input!! But then this blacklist under Email Filtering makes no sense at all if it's not possible to block a specific sender, but only mark it as spam. Are there any options with Fortigate (without Fortimail) to block emails from specific senders (this is possible with both Sophos and Cisco)?

[abelio]

Hello nk22
Just mark your spam action as 'discard'
Is better than 'reject', no info back to the spammer; just silently drop.

[nk22]

Hi Abel, that sounds good. Unfortunately I don't know where I can select 'discard'…

[AEK]

Hello NK22

When you set action "Mark as Spam" in the allow/block list, that doesn't mean that the mail will reach your mail box as spam, but the Antispam profile that contains this allow/block list will perform the action that you set in "Spam Action" for SMTP protocol.

So for your case you need to do two action in order to get what you want:

• in the allow/block list, set the action to "Mark as Spam" for the undesired sender

• in the Antispam profile containing the above/block list, set the "Spam Action" for SMTP Protocol to "Discard", not to "Tag"

[abelio]

Hi
within the email filter profile, open submenu 'Spam Detection by Protocol' , under spam action for SMTP you can choose 'discard' as an option to deal with the messages matching the profile