Fortimail external hosting

[whoami1]

Hi, I'm having a problem with Fortimail as a VM on the gateway website. Unfortunately, I can't communicate with the SMTP.ore server.

I've taken the following steps:

FML public address
Exposed public IP ports to FML -> 475, 587
Entered server communication via SMTPs in FML

Added an A record in the hosting
Added an MX record indicating this server as a higher priority
Is an SPF record really necessary?

Has anyone had similar problems? Is there a solution?

The hosting is blocking port 25

[abelio]

Hello
Could you provide a diagram (simple, hand drawing ) describing your topology please?
It's necessary to understand exactly the problem to be solved.
Let me explain:
- SPF record is required for big email players (gmail, 365 etc) nowadays in order to accept emails sent from your domain
- MX record is mandatory to define where to send email to your domain
- "Hosting provider blocking port 25" is related generally with SMTP traffic internally generated

We understand that your FML is in gateway mode protecting email to/from your hosting infrastructure; if not, please explain a bit more

regards

[whoami1]

Forti in gateway mode

port 465 , 587

vm Fortimail -> external hosting 

DMZ for example LAN: 10.10.10.5 -> virtual IP: 5.5.5.5

Policy:
wan
to vlan1500
source all
dest fortimail

I read that I need to use spf record right now, this is problably my solution ? I will try

hosting ins't be 365 or gmail.

[whoami1]

My FML is acting as a gateway. I contacted my hosting provider, and they told me I need to change the PTR records to my FML. Is that correct? I changed the SPF. I have emails in the logs, but Fortimail isn't sending emails to the hosting provider.

I've run some tests, and Fortimail is contacting the hosting's main IP address, not my public address. Could this be my problem?

[AEK]

Hi Whoami

Yes you need the public IP of FML to point to the FML FQDN. This is the PTR record. Otherwise your mails are rejected by the remote server/MTA.

On the other hand, can you perform these basic tests?

• On FML GUI, go to monitor, logs, and see what is happening to the outgoing mails, check if they are sent or still queued
• From FML CLI: exec ping fortinet.com
• From FML CLI: exec telnet smtp.fortinet.com 25
• From FML CLI: exec telnet smtp.fortinet.com 465

Then share the output.

[whoami1]

Host Resolved [serwer1111111.hosting.it:25]
Connection Connected

>>>> Test Trace >>>>
connect to host 1.1.1.1 (main external hosting, not public from my env)
<<< 220 cloudserver3273017-3273048.domain.it ESMTP Mailsystemx
<<< 220 cloudserver3273017-3273048.domain.it ESMTP Mailsystemx

>>> ehlo
<<< 501 Syntax: EHLO hostname

>>> quit
<<< 221 2.0.0 Bye

[whoami1]

What I did:

Change name fml, record A = name

Public IP

Record A  mail.domain com 1.1.1.1

Record text spf v=spf1 ip4: 1.1.1.1 ip.4 2.2.2.2 - all

PTR to change record ptr I need my own public ip in hosting (now it;s shared... )

open 1.1.1.1 25

open local 192.168.50.50 (example) 465 25

So it is probably solution for future ? 

[AEK]

Your FML can connect to outside on port 25.

Now run a mail-tester check and share the detailed result to see what is wrong with your setup.

https://www.mail-tester.com/

You can hide the sensitive info from the result if required.