FortiMail 200E Inbound Email Sender Reputation

[nwillia09]

I am slowly migrating from a Barracuda 300 to the FortiMail 200E. I am looking at the logs on the FortiMail 200E and noticed that all of the inbound emails show the same client IP address which happens to be the gateway address of the DMZ network in which the fortimail is installed in. The fortimail is in gateway mode and behind NAT.

I had Sender Reputation enabled until my client IP was getting scored high which delayed all inbound email. Is this normal behavior when installed behind NAT?

Could this also be related to the "Extract IP from Received Header" option that I enabled under my AntiSpam Profile?

[emnoc]

Most likely not.

The upstream firewall is probably SNAT'ing the clients behind that one-single address which as you  indicated is defeating reputation scoring ;)

Flow trace the  sessions and remove the SNAT.

[nwillia09]

Indeed removing the source NAT from my firewall policy resolved the issue. My logs are no longer masqueraded.