Antispam, Antivirus, and Content Filtering
This domain tests layered message inspection: which engine catches which threat, how profiles are attached, and what each action does. Questions often describe a message that was tagged, quarantined, delayed, or delivered despite a filter, and ask you to identify the cause.
Antispam layers
- FortiGuard Antispam provides cloud reputation; DNSBL and SURBL check connecting IPs and message URIs.
- Greylisting temporarily rejects unfamiliar senders; legitimate servers retry, while many bots do not. It causes delay by design.
- Bayesian, heuristic, and banned-word checks add local scoring; SPF, Sender ID, DKIM, and DMARC validate sender identity.
- An antispam profile sets thresholds and actions: tag, quarantine, discard, or reject. Personal quarantine lets users review their own spam.
Antivirus and content
- FortiGuard antivirus signatures, heuristics, and emulation inspect attachments and message bodies; sandboxing can detonate suspicious files.
- File filters block or quarantine by file type, name, or size. Encrypted archives may be unscannable unless blocked or handled by policy.
- Content profiles use dictionaries and banned words to match text. Attachment and content actions can tag, quarantine, or block.
- Profiles do nothing until a recipient policy applies them to the correct direction and domain.
Worked example
A customer wants to block macro-enabled Office files inbound but allow them from one trusted partner. Create a content profile with a file filter for the macro-enabled extensions and set the action to quarantine. Apply it to the inbound recipient policy for the customer domain. Put a specific recipient policy for the partner domain above it with a profile that does not block those files, or use a bypass rule. Reason: first-match policy order means the exception must be evaluated before the broad block; otherwise the partner is quarantined too.
Traps
- Creating a profile but never attaching it to a recipient policy.
- Confusing tag, which delivers with a modified subject, with quarantine, which holds the message.
- Forgetting that greylisting is supposed to delay mail.
- Blocking encrypted archives but expecting content scanning to see inside them.
- Applying inbound profiles to outbound mail, or vice versa.
- Releasing a quarantined message without checking why it matched.