Header From field check

[chels]

Hello,

Since some time, I have more spam where From SMTP address is different from Header From address.

In MS Outlook Header From is displayed; this address is used to steal identity.

Can I configure Fortimail in order to also check Header From address?

Thank you

(Fortimail 5.4.x)

[Dirty_Wizard_FTNT]

Check header From against what?

You can set FortiMail to check the header From email domain against SPF:

config antispam settings

set spf-checking strict-anti-spoofing end

Page 44: https://docs.fortinet.com/uploaded/files/4495/fortimail-cli-reference-546.pdf

Is the header From email spoofed as your own domain?

[Carl_Windsor_FTNT]

If the spam is spoofing the protected domain, you can use the 6.0 Impersonation detection feature.   

In the next major release we will be separating the header alignment check from the spf-checking strict-anti-spoofing setting to allow more flexibility in configuration - although blocking all lack of alignment will generate false positives so it is recommended to tag the subject/top of email rather than block.

[Hosemacht]

you can use the dictonary filter to set a regular expression for the header:

[EHeAdEr]^from:.*\b\@example.com\b

Change "@example.com" to your Domain name 

set "Search Header" enabled and add it to your antispam profile.

[PP2]

Hello all,

  with reference to the comment above ("If the spam is spoofing the protected domain, you can use the 6.0 Impersonation detection feature"), does anybody know how to implement it for the entire domain (and not for specific accounts only)? 

We are being swamped by emails spoofing the headers. These were detected with version 5.4.x, but are coming trough now. 

I have a case open with support but all what I am getting are suggestion to turn on alignment check, that will not work in our  case. 

Thanks!

[sotir1984]

Hi,

How about whitelisting based on "Header From"

There are some time sensitive emails that are being held by "spam outbreak" such as OTP's.

Most of them are sent from same "header from" but various "from". Now i don't want to whitelist all "from" from outbreak, so it would be beneficial if there is a tweak that can make the FortiMail check "header from" first, before it processes "from"

Anybody else got this problem?

-1984-

[Hosemacht]

i would highly recommend not to use whitelistening based on a Header From Field.

Every email matches this header will get through without an AS check.

Furthermore i guess its not possible at the moment with a FortiMail.

Regards

[live89]

I think this is what you're lookiing for

https://kb.fortinet.com/k....do?externalID=FD45736

[Novox]

Hi, I'm trying to use:

[EHeAdEr]^From:.*\b\@domain.com\b

However, shouldn't the period before .com be preceded with \ so that \. matches literally "."  Otherwise it's matching any char (which is also fine, since "." will match "period").

My confusion is in the "[EHeAdEr]" part...

As far as I understand RegEx's, this means choose ONE of the following literal characters E, H, e, A, d, E, r.  And I don't know why this would be necessary because ^ means "beginning of line or string"

Also, should there be a /i at the end for "case-insensitive"?

Previously, I had:

/^from:.*\bdomain\.com\b/i

which was causing issues?!   (matching things it should never match).

Thank you!

[Jeff_Roback]

I don't know why support keeps giving out this Regex string.    As pointed out above, it has two problems:

1) The . in domain.com is evaluated as matching any character since it's not escaped.

2) The [EHeAdEr] isn't helping since a match of any of those characters will work.

This string seems to have originated from this post: https://forum.fortinet.com/tm.aspx?m=190591&high=fortimail+spf  but I'm not entirely if it was a typo from the author or a misunderstanding,

In any event, it's a bit troubling that support keeps giving this out. 

Here's what we've been testing with:

^From:.*<.*\@mydomain\.com>$

Here's a really handy site that lets you put in a regex string and test it against text. It will also break down the command for you.

https://regexr.com/