Filtering order
The FortiGate checks for spam using various filtering techniques. The filtering order used by the FortiGate depends on which mail protocol is used.
Filters requiring a query to a server and a reply (FortiGuard Antispam service and DNSBL/ORDBL) are run simultaneously. To avoid delays, queries are sent while other filters are running. The first reply to trigger a spam action takes effect as soon as the reply is received.
Each spam filter passes the email to the next if no matches or problems are found. If the action in the filter is Mark as Spam, the FortiGate tags the email as spam according to the settings in the email filter profile. If the action in the filter is Mark as Reject, the email session is dropped. If the action in the filter is Mark as Clear, the email is exempt from any remaining filters. For SMTP and SMTPS, if the action is Discard, the email is discarded or dropped.
SMTP and SMTPS spam filtering order
The FortiGate scans SMTP and SMTPS email for spam in a specific order, which depends on whether or not the local override feature is enabled. This feature is disabled by default, but enabling it gives priority to local spam filters.
You can enable local override (set local-override
) in an email filter profile to override SMTP or SMTPS remote checks, which includes checks for IP RBL, IP FortiGuard AntiSpam, and HELO DNS with the locally defined antispam block and/or allow lists.
![]() |
SMTPS spam filtering is available on FortiGates that support SSL content scanning and inspection. |
To configure local override of an antispam filter:
config emailfilter profile edit <name> set spam-filtering enable set options spambal spamfsip spamfsurl spamhelodns spamfsphish config smtp set local-override {enable | disable} end set spam-bal-table 1 next end
Local override disabled |
Local override enabled |
---|---|
|
|
IMAP, IMAPS, POP3, and POP3S spam filtering order
The FortiGate scans IMAP, IMAPS, POP3, and POP3S email for spam in the following order:
- MIME headers check, email address block/allow list check
- Banned word check on email subject
- IP block/allow list check
- Banned word check on email body
- Return email DNS check, FortiGuard email checksum check, FortiGuard URL check, DNSBL and ORDBL checks
![]() |
IMAPS and POP3S spam filtering are available on FortiGates that support SSL content scanning and inspection. |