Whitelist DocuSign

[roci]

I am running FortiMail v7.0.x and the spam aggressiveness is set a bit on the high side. We are aware of email scams that appear to come from DocuSign but are not from DocuSign. These are all getting quarantined.

However, legit emails from DocuSign are also getting quarantined and I am looking for the best way to allow these.

Currently, every time a user receives a real DocuSign email, FortiMail will move it to quarantine due to "Sender Alignment: (From value: docusign.net) does not align with Reply-To domain"

As a convenience, when someone sends you a (real) DocuSign email, the From address is something like 'Mike Smith via DocuSign <dse_na2@docusign.net>' but the Reply-To address is the sender's email address. For example 'mike.smith@companyx.com'.

DocuSign has a KB article that lists their domains and IP addresses - https://www.docusign.com/trust/security/esignature

How can I create a recipient policy that says if an email comes from one of these IPs or domains, whitelist and deliver the message, bypassing quarantine, spam outbreak, etc?

[Jean-Philippe_P]

Hello roci, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[gmichailidis]

Hello roci,

The 'Sender Alignment' filter performs a comparison check between "Envelope Sender & Mail From" and "Mail From & Reply-To" headers and triggers the corresponding action when there is a mismatch in either one.

It is generally not recommended to safe list entire domains.
As an alternative, I would recommend to create a dedicated policy for emails coming from the IP ranges published by DocuSign.

1. You can create a new IP policy, with source 'IP group', which will be populated with the IP ranges published by DocuSign.
The destination IP address can be set to 'any' 0.0.0.0/0.
This way, we are able to isolate validated DocuSign mail flow in this IP policy.

If the maximum entries of the IP group are reached, you can create a second one or even third one, to use in extra policies.

2. This IP policy will be equipped with a new AntiSpam Profile, which will have the 'Sender Alignment' filter turned off.
You can do this quickly by cloning the currently used AntiSpam profile and editing it to disable 'Sender Alignment'.

Profile > AntiSpam > Select the currently used AntiSpam Profile > click 'Clone' > Specify a name and a domain for the new Profile.

3. In the IP policy settings by double clicking the IP policy, scroll down and expand the 'Miscellaneous' section.

Under this section, we can enable 'Take precedence over recipient based policy match'.
This option will ignore the recipient policies and apply the profiles configured in the IP policy.

You can verify that the setting is used by the green check mark icon in the right end of the IP policy settings.

4. Make sure that the policy is equipped also with AntiVirus and Content Profiles, according to your needs for this mail flow.

This configuration ensures that specific IP Policies are used for DocuSign mail flow with the filters that cause the false positive disabled.
However, we are still scanning the inbound mail flow with other filters.

If there are any queries on the configuration, please let me know.

Have a nice day.

Sincerely,
Georgios Michailidis

[Faiza_Emam_Delhi]

Hi ,

To whitelist DocuSign emails and bypass the quarantine and spam outbreak filters, you can create a custom policy in FortiMail. Here are the steps to follow:

1. Log in to the FortiMail web interface.

2. Go to "Policy & Objects" > "Recipient Policy" and click on "Create New".

3. Enter a name for the policy and select the domains or email addresses that you want to whitelist. You can use the DocuSign KB article to identify the domains and IP addresses to whitelist.

4. Under "Inbound Mail Flow", select "No Security Profile" and "No Anti-Spam Profile". This will bypass the quarantine and spam outbreak filters.

5. Click on "OK" to save the policy.

Once you have created the recipient policy, any emails received from the whitelisted domains or email addresses will be delivered directly to the recipients without being quarantined or filtered for spam.

I hope this helps! Let me know if you have any further questions or if there's anything else I can assist you with.