FortiMail unit is bypassed

[#1]

Article

FortiMail units can be physically bypassed in a complex network environment if the network is not carefully planned and deployed. Bypassing can occur if SMTP traffic is not correctly routed by intermediary NAT devices such as routers and firewalls.

If your FortiMail unit will be performing antispam scans on outgoing email, all outgoing email must be routed through the FortiMail unit. If your email users and protected servers are configured to relay outgoing mail through another MTA such as that of your ISP, the FortiMail unit will be bypassed for outgoing email.

Spammers can easily determine the lowest priority mail server (highest preference number in the DNS MX record) and deliver spam through that lower-priority MX in an attempt to avoid more effective spam defenses.

To ensure that spammers cannot bypass the FortiMail unit:

1. Configure routers and firewalls to route SMTP traffic to the FortiMail unit for scanning.
2. If the FortiMail unit is operating in gateway mode, modify the DNS server for each protected domain to keep only one single MX record which refers to the FortiMail unit.
3. Verify that all possible connections have a matching policy. If no policy matches, the connection will be allowed but will not be scanned. (To prevent this, you can add a policy to the bottom of the IP policy list that rejects all connections that have not matched any other policy.)
4. Verify that you have selected an antispam profile in each policy, and have enabled antispam scans.