Return address doesn't match headers

[patrickwilson82]

Hi,

Is there a way to set my Fortimail to filter out messages where the From Address is spoofed, and doesn't match what is in the headers? i.E. We received an email that said it was from our CEO at our parent company's but the headers showed this as being from a google address.

[abelio]

Hello Patrick

SPF/DMARC/DKIM are your friends; set up those records in your DNS zones and re-configure your antispam profiles to use it.

Problem solved.

[patrickwilson82]

Thank you for the reply. SPF and DMARC checking are already set up on the AntiSPAM inbound policy. I'm not sure that outbound would apply since the spoofed emails from our CEO are on our parent company's domain. Do I need to look into setting up impersonation analysis?