Hello,
Since some time, I have more spam where From SMTP address is different from Header From address.
In MS Outlook Header From is displayed; this address is used to steal identity.
Can I configure Fortimail in order to also check Header From address?
Thank you
(Fortimail 5.4.x)
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Check header From against what?
You can set FortiMail to check the header From email domain against SPF:
config antispam settings
set spf-checking strict-anti-spoofing end
Page 44: https://docs.fortinet.com/uploaded/files/4495/fortimail-cli-reference-546.pdf
Is the header From email spoofed as your own domain?
If the spam is spoofing the protected domain, you can use the 6.0 Impersonation detection feature.
In the next major release we will be separating the header alignment check from the spf-checking strict-anti-spoofing setting to allow more flexibility in configuration - although blocking all lack of alignment will generate false positives so it is recommended to tag the subject/top of email rather than block.
Dr. Carl Windsor Field Chief Technology Officer Fortinet
you can use the dictonary filter to set a regular expression for the header:
[EHeAdEr]^from:.*\b\@example.com\b
Change "@example.com" to your Domain name
set "Search Header" enabled and add it to your antispam profile.
sudo apt-get-rekt
Hello all,
with reference to the comment above ("If the spam is spoofing the protected domain, you can use the 6.0 Impersonation detection feature"), does anybody know how to implement it for the entire domain (and not for specific accounts only)?
We are being swamped by emails spoofing the headers. These were detected with version 5.4.x, but are coming trough now.
I have a case open with support but all what I am getting are suggestion to turn on alignment check, that will not work in our case.
Thanks!
Hi,
How about whitelisting based on "Header From"
There are some time sensitive emails that are being held by "spam outbreak" such as OTP's.
Most of them are sent from same "header from" but various "from". Now i don't want to whitelist all "from" from outbreak, so it would be beneficial if there is a tweak that can make the FortiMail check "header from" first, before it processes "from"
Anybody else got this problem?
-1984-
-1984-
i would highly recommend not to use whitelistening based on a Header From Field.
Every email matches this header will get through without an AS check.
Furthermore i guess its not possible at the moment with a FortiMail.
Regards
sudo apt-get-rekt
Hi, I'm trying to use:
[EHeAdEr]^From:.*\b\@domain.com\b
However, shouldn't the period before .com be preceded with \ so that \. matches literally "." Otherwise it's matching any char (which is also fine, since "." will match "period").
My confusion is in the "[EHeAdEr]" part...
As far as I understand RegEx's, this means choose ONE of the following literal characters E, H, e, A, d, E, r. And I don't know why this would be necessary because ^ means "beginning of line or string"
Also, should there be a /i at the end for "case-insensitive"?
Previously, I had:
/^from:.*\bdomain\.com\b/i
which was causing issues?! (matching things it should never match).
Thank you!
I don't know why support keeps giving out this Regex string. As pointed out above, it has two problems:
1) The . in domain.com is evaluated as matching any character since it's not escaped.
2) The [EHeAdEr] isn't helping since a match of any of those characters will work.
This string seems to have originated from this post: https://forum.fortinet.com/tm.aspx?m=190591&high=fortimail+spf but I'm not entirely if it was a typo from the author or a misunderstanding,
In any event, it's a bit troubling that support keeps giving this out.
Here's what we've been testing with:
^From:.*<.*\@mydomain\.com>$
Here's a really handy site that lets you put in a regex string and test it against text. It will also break down the command for you.
Jeff Roback
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1536 | |
1029 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.