FortiMail let spam mail through

[unknown1020]

Friends a question:

I have a Fortimail device, according to the logs it appears that the Fortimail let a SPAM email through.

Reviewing the AntiSpam Profile, it appears that the action selected is "Dafault", my question is what action does the "default" take?

What configurations do you recommend to prevent Fortimail from letting spam emails through?

[AEK]

Hi Unknown

The action "Default" is the one you set in the "Default action" field at the top of the AntiSpam profile view. In your case it is UserQuarantime and it is fine, I think it is the recommended once, since you will be able to find any false positive in the FML's quarantine folders.

Now if you have some false negatives (spam mails allowed by FML) then you need some tuning in your AntiSpam profile or Session profile or other, depending on the characteristics of the received spam mails, I mean you may need to analyze them (to see what characterizes them as spam) and compare with your profiles to see why they have been allowed, then you can tune your profiles according to your findings so FML will block them next time.