How to know if an email traffic reach my FortiGate or not at all?

[PFU]

Hi experts, I am totally new to Fortigate, would like to ask a question here. My customer's company use application to send out PO(Purchase Order) to my colleagues' email addresses, but the colleague didn't receive that email sent by the Customer PO application(po_nmc@customer-domain) on 12 Aug. After that the customer use his email account user1@@customer-domain sent on 20 Aug and successfully reached my colleague's inbox(colleague1@my-company).

I checked the report and log > anti-spam, did not find any blocking record for the Customer PO application address(po_nmc@customer-domain), so i am wondering did this email(12 Aug) reach my Fortigate? it's not been blocked as a spam, I check the exchange server behind the firewall, there's no such mail record from that sender. 

how can i tell what happened to the email(sent on 12 Aug from customer to my colleague)?

any help will be greatly appreciated.

[Dave_Hall]

You may have better luck looking at the mail headers of the sender email - that PO app (or mail server) should be tracking the mail delivery path to let you know if it has successfully reached the destination (mail server/mail box).  If this PO app is deemed business critical, I can't imagine it not having some sort of email delivery or return receipt feature build into it.

[PFU]

Hi Dave, SW2090 and Yurisk,

Thank you for your time and sharing various methods to fix it. Yes, non-delivery report is common practice, we have set logging at fortigate. The reality is this case is not technical but in the business world in my area, customer's P/O is untouchable, customer is NOT happy to be shown his failure to monitor the sending status, not willing to check with his admins for NDR, customer likes to insist he done his job and the supplier shall had received the order, and my colleague the supplier is reluctant to trouble the customer since the customer resent the P/O with his email (not from P/O application) and received safely. Science or Art doesn't matter as long as P/O received, IT can't bypass the sales and contact his customer, can't get a copy of the non-delivery email, nor NDR. The only thing can do is show my sales the fortigate log and mail server delivery report findings to prove that we didn't receive nor block his customer. Have a nice day :)

[sw2090]

I don't think you could still look that up anywhere.

If the issue still exists you could start some flow debug on your FGT and then have the customer send you a mail via that PO Application.

You could limit that to the Port (25 for SMTP or imo 587 for SMTPS) or/and to the ip of the customers mailserver if you can get it or Mail-Proxy/gw if there is between. Then you would see on cli if any thraffic from there that is SMTP reaches your FGT.

Additionally it might be taken care for on your customers side as his admins could check on the customer's mailserver to see what happened to that mail.

[Yurisk]

If you don't have logs for that there is nothing on Fortigate side you can do about.  On the other hand the sending mail server will have all the needed info - if you didn't see it being dropped by Fortigate antispam, nor saw it in your receiving mail server logs, then most probably the mail will eventually bounce and original sending mail server will receive non delivery (NDR) with reason and all the info included.  Usually mail don't just disappear, but all the info will be on the sending side, not yours.

[PFU]

Hi Dave, SW2090 and Yurish, Thank you all for your solutions, all works well for this case.

Regards,

pfu