Fortimail False positives

[NeoRant]

Hi Guys, 

I am grateful for this community, some great teachers here, I am learning alot about Fortimail and have done some good work so far.

I have now fully integrated my fortimail in the DMZ, the fortigate fwl, getting smtp traffic, inspection of smtp traffic actually WORKING, thank God.

However, one problem lol. ALOT of false positives and people are squealing. I used the full inspection rules instructed by guide below - antispam, antivirus, content etc and I tell you mails are being inspected hard.

https://ebin.pub/fortinet-fortimail-lab-guide-for-fortimail-72.html

Can anyone here post me a good setup for traffic inspection (not so robust/sensitive)?

I am currently using the recipient policy as that is what was selected by my team. I was the one that configured the fortimail from scratch and deployed it(with the help/knowledge of you guys of course).

[AEK]

Hi NeoRant

Congratulations for your first prod FML integration. The first is the harder, and the following ones will be fast and easy.

You can share your false positives and we will try help.

But the good method is first to know the order of execution:

https://docs.fortinet.com/document/fortimail/7.4.2/administration-guide/521188/how-fortimail-process...

Keep that table next to you when you try resolve false positive issues. For example you will understand that if a legitimate mail was blocked due to IP reputation then safe-listing will not help, as the IP reputation is checked before the safe-listing.

[NeoRant]

Hi AEK,

Thank you for this, i will review and provide update.

Regards,

[AEK]

Additionally regarding your false positives, usually it is due to a hard AntiSpam profile, so I'm sharing here an AS profile that I usually setup as the main inbound profile.

Hope it helps.

[NeoRant]

Hi AEK, 

Thank you very much. I will work in this and let you know soon. Cool stuff.

Regards

[NeoRant]

Hi AEK,

I made some tweaks, but thanks a lot for the advice.

Regards

[NeoRant]

Hey AEK,

I love the inspection settings you posted earlier; it works wonderfully. However, staff still getting some false positives and those mails are sent straight to the bulk/quarantine folder LOL. From gmail domain to unpopular ones, missing mails having attachments - images etc. I set my IP/recip policy similar to yours above to avoid staff complaints. But I still find myself releasing quarantine mails for most people. I can make changes by turning off a few handles, but i don't want to affect the global FML environment. Also, most features are set to default, so i am not sure why the false positives. I used a recipient policy before that had STRICT inspection profiles, but i used yours to reduce staff annoyance, yet still, staff still not getting some mails. Any help / suggestions. If you or anyone could share recipient/IP policy with a more relaxed yet robust inspection profiles, please feel free to share.

[AEK]

Hi NeoRant

It's so normal to have some false positives, especially in the first days following the integration. I think you should keep the AS settings tight and mitigate the false positives by safe-listing case by case. This is because some of your legitimate correspondents may have poor reputation, and you shouldn't lower the guard globally, but treat them one by one.

Usually you use safe-listing to mitigate false positive, but if it doesn't work you need to inspect the related session and understand why the mail has been quarantined, and once you find the cause you lake an exception for that domain or IP or sender (usually a dedicated IP policy, AS profile or other).

[NeoRant]

Hi AEK,

Good point. I will update you all on my progress, thanks again AEK.

[Cajuntank]

One thing I'd like to say that was my initial cause of a lot of false positives were the amount of DNSBL sites I had added from seeing some examples online from various places (i.e... YouTube, Reddit, etc...).  I had 10 sites defined and all of my headache was due to that. I scaled mine down to like 2 and now I very rarely encounter a false positive while my catch rate for legit spam is very high.