Fortinet Fortimail

Te c h n i c a l T r a i n i n g

Disclaimer
This content is not related to Fortinet education from any side and nothing from the inner content ( documents , labs , expressions )
are attributed to Fortinet paid portals or documentation guides , All slides are made by instructor effort with screenshots from giant
labs , labs are practiced in private environment “EVE-NG Community Version” , all rights are reserved.
 Session Profile
Session Profile :- Focuses on the connection and envelope portion of the SMTP session . This is contrast to
other types of profiles that focus on the message ( Header , Body Or Attachments ) .
-- Like :- MAIL FROM :- ….
RECPT TO :- ….
-- By default there are two main profiles :- ( Inbound / Outbound ) .
Components :-
1) Connection Settings :- Gives you options about the connection settings of the client to fortimail like
( maximum concurrent connections , Number of messages of a client , … ) ..
Again :- Keep settings at the default if you don’t need to change them .
Description
Connections
Number of MAIL FROM ( 0 Means No Limit )
number of RCPT TO ( 0 Means No Limit )
concurrent connections per client
Enter a limit to the number of seconds a client may be idle before the FortiMail unit drops the connection.

1
 Session Profile
2) Sender Reputation :- Records the sender ip address and the number of good email and bad email
messages from the sender . And according to this number of course related to the configuration it will
take a decision .
-- Also it will query FortiGuard ip reputation check for checking specific ip address “if it’s malicious or
not” .
3) Endpoint Reputation :- Will do the same thing but on the level of the endpoint itself
Description
Enable to accept or reject email based upon sender reputation scores.
Score that will be used to rate limit the smtp client messages.
Maximum number of email messages per hour FortiMail unit will accept from a throttled
percentage of the number of email messages the SMTP client sent during previous hour.
Enter a sender reputation score over which the FortiMail unit will return a temporary failure error
when the SMTP client attempts to initiate a connection.

Enter a sender reputation score over which the FortiMail unit will reject the
email and reply to the SMTP client with SMTP reply code 550

FortiGuard IP Reputation Check Use AntiSpam Settings :- This action happens after the entire message has been received by FortiMail
When Client Connects :- And this action will happen during the connection phase

2
 Session Profile
Description
Enable to accept, monitor, or reject email based upon endpoint reputation scores.
Reject Or Monitor
Enter the MSISDN reputation score that will be chose to be blocked
Block duration

Used With Dynamic IP Addresses

4) Sender Validation :-
-- SPF Check :- Sender Policy Framework , Check if the sender is really who it is through comparing the
SPF record that is published in the public DNS of this server .
>> After validation score of the sender will be changed according to result of verification , EX ( Fail
Means score will increase ) & ( Authenticated Means score will decrease ) .
>> It only helps in detecting that the email client sends spam since it helps in scoring
>> SPF can be enabled on session profile or antispam profile .
But if the action on session profile is bypass , it will not be checked under antispam profile even if
you enable it .

3
 Session Profile
// And you can check that reputation changed here according to that sender
doesn’t have any sfp record .

-- DKIM Check :- Is used to check if the sender mail server has DKIM ( Digital Signature ) is working fine
on the external mail server by checking that the DKIM is published on the public DNS server for the
external server .

4
 Session Profile
>> DKIM stands for DomainKeys Identified Mail and is used for the authentication of an email that’s
being sent .
>> DKIM gives emails a signature header that is added to the email and secured with
encryption. Each DKIM signature contains all the information needed for an email server to
verify that the signature is real, and it is encrypted by a pair of DKIM keys.
>> A domain owner adds a DKIM record being sent . A normal txt record contains public key used for
decryption .

5
 Session Profile
-- LAB For DKIM :- Two main verification processes , we need others verify us & we need to verify
others .
VERIFYING OTHERS :-
1) On Fortimail :- Enable DKIM option on the session profile that will be applied on the incoming
profile .

6
 Session Profile
2) Download OpenSSL to generate private & public key to be used for the remote hmail server (
[Link] )

7
 Session Profile
3) Upload the private key on the hmail server to encrypt signature with .

8
 Session Profile
4) Publish the dns record that will contain the public key in the record of the [Link]

9
 Session Profile
BEING VERIFIED :- External mail servers need to see our public key in DNS records if we signed the
outgoing mail messages .
-- LAB DKIM Enabling :-
1) Enable DKIM and generate the private and public keys on the level of domain .

10
 Session Profile
2) Enable DKIM signing from session profile on the outgoing profile .

11
 Session Profile
3) Publish the public key on the DNS record for our internal server “[Link]” .
// IN OUR LAB , it must be put manually on the dns server of [Link] mail server .

12
 Session Profile
Session Settings Description
Session Action Choose session action.
Message Selection Applied to all messages or accepted
message only.
Reject EHLO/HELO Replying with reject 501 if sender is sending
Commands With Invalid invalid characters in domain names inside
Characters in the domain greetings

Perform Strict Syntax Replying with reject 503 if syntax of SMTP

Checking commands is used incorrectly

Session Settings Description

Ack EOM Before Acknowledge EOF ( End Of Message ) Using CRLF Checking Directly without waiting antispam checks to be
AntiSpam Check finished

13
 Session Profile
Unauthenticated Session Description
Settings
Check HELO/EHLO Domain Check domain name exists in SMTP command against MX & A records , if not existed , reject .

Check Sender Domain Same concept but here checking of the domain name will be inside sender portion .

Check Recipient Domain Same also but checking is inside recipient portion ( domain name inside recipient portion ) .

Reject Empty Domain If sender is using SMTP command without a domain name or sender portion doesn’t have a domain
name .
Reject if recipient and HELO Reject If : HELO/EHLO Matches RCPT TP But MAIL FROM not matching , this could be used by
domain match but sender spammers to hide identity .
domain is different

14
 Session Profile
SMTP Limits ( 0 disables the limit ) Restrictions on SMTP Connections

Error Handling Errors sometime indicate attempts to misuse the server.

You can impose delays or drop connections if
there are errors. Setting any of these values to 0
disables the limitations on SMTP Connections

Header Section including options to add your operations on

Manipulation headers that are existed inside email messages , existed
by default or added through email messages softwares ,
this could be used to decrease message size .

15
 Session Profile
>> Lists :- Could be configured to include lists ( blocklist / whitelist ) .

16