How FortiMail inspects inbound and outbound email: deployment modes, sender authentication, sandboxing, CDR, encryption and the operating practices that matter.
FortiMail is Fortinet's email security platform: it inspects inbound, outbound and internal messages to block spam, phishing, malware and impersonation before they reach users, and it can add encryption and data leak controls to outgoing mail. It is available as a hardware appliance, a virtual machine, a public cloud image or a hosted service, and since 2025 Fortinet has marketed it within a broader offering called FortiMail Workspace Security.
Email remains one of the most common entry points for attacks. CISA's #StopRansomware Guide lists phishing among the main initial access vectors for ransomware, alongside exposed vulnerabilities and stolen credentials. Built-in filtering handles bulk spam reasonably well; targeted messages are harder, such as a spoofed supplier invoice or a link that turns malicious after delivery.
A dedicated email security gateway adds several layers that work together: reputation checks on the sending infrastructure, sender authentication, content analysis, attachment and URL inspection, and policy enforcement on what leaves the organisation.
FortiMail supports three operation modes, and choosing the right one is the first design decision:
For organisations on Microsoft 365, FortiMail can also work through API integration. The FortiMail 8.0.0 release notes list Microsoft 365 inline scanning and shared mailbox scanning among the new features, which gives more options for tenants that do not want to change their mail flow.
Inspection happens in stages, and understanding their order helps when troubleshooting a false positive or a missed threat.
The first stage evaluates the connection: IP reputation from FortiGuard services, rate limits, and recipient verification to reject messages for mailboxes that do not exist. The second stage checks sender authentication. SPF verifies that the sending server is allowed to send for the domain, DKIM verifies a cryptographic signature on the message, and DMARC ties both to the visible From domain and tells receivers what to do when checks fail. Note that DMARC was revised by the IETF in May 2026: RFC 9989 now defines the protocol and replaces RFC 7489, with reporting moved to RFC 9990 and RFC 9991.
The content stage then applies antispam heuristics, antivirus engines, URL analysis and, when licensed, sandboxing of suspicious files through FortiSandbox or its cloud equivalent. Content disarm and reconstruction (CDR) can rebuild Office and PDF documents without active content such as macros. Impersonation analysis compares display names and domains with those of executives and trusted partners to catch business email compromise attempts, which often carry no attachment or link at all.
Recent releases address newer evasion techniques. FortiMail 8.0.0, for example, adds scanning of password-protected attachments by prompting the recipient for the password, and QR code detection inside PDF files, a technique increasingly used to move victims from a corporate device to a less protected phone.
Security does not stop at inbound traffic. FortiMail can encrypt sensitive outgoing messages, either with standard S/MIME or TLS enforcement between servers, or with identity-based encryption that lets external recipients read a message through a secure portal. Content rules can detect patterns such as card numbers or confidential document labels and quarantine, encrypt or block the message. Outbound scanning also keeps a compromised internal account from getting the domain block-listed.
A well-designed deployment still needs regular attention:
Email security sits at the crossroads of messaging, networking and incident response. Administrators benefit from a solid grounding in Fortinet's ecosystem, since FortiMail logs and alerts usually end up in the same analysis platform as FortiGate events. The FortiAnalyzer 7.6 Analyst – NSE 5 Security Operations certification preparation covers log analysis and investigation in that context. For a vendor-neutral view of email-borne threats, detection and response, the CompTIA Security+ certification preparation is a good foundation, and teams handling phishing incidents can build method with the E|CIH Certified Incident Handler training.
FortiMail brings layered inspection, sender authentication, sandboxing and outbound controls together in one platform, with deployment modes that fit on-premises servers as well as Microsoft 365. Its value depends on correct placement, sound authentication records for your own domains and continuous tuning. Treat it as part of a wider detection chain, not as a standalone filter, and invest in the skills of the people who operate it.