FortiMail

FortiMail is Fortinet's enterprise email security gateway. It inspects all inbound and outbound SMTP traffic in multiple layers against spam, phishing, malicious attachments, ransomware, impersonation and business email compromise (BEC) attacks. It can be deployed as a hardware appliance, a virtual machine, a cloud service, or as a Microsoft 365 / Google Workspace API integration.

Email is still the most frequently used door into the corporate network. In ENISA's threat landscape report, which analysed 4,875 incidents between 1 July 2024 and 30 June 2025, phishing came first by a wide margin, accounting for 60% of initial access vectors (ENISA Threat Landscape 2025). In Verizon's 2025 breach investigations report, which covers 1 November 2023 to 31 October 2024, ransomware was present in 44% of the breaches analysed; among SMB-scale organisations that figure rose to 88% (Verizon DBIR, 2025). The first link in that chain is almost always a delivered message; FortiMail's job is to stop that message before it reaches the user.

Which email threats does FortiMail stop?

FortiMail addresses six core risk classes: unsolicited bulk mail (spam), phishing and spear phishing, attachments carrying malware, unknown (zero-day) files, impersonation and BEC attacks, and outbound data leakage. Detection does not rely on a single engine but on layers stacked on top of one another; what one layer misses, the next catches.

The first layer is connection and sender inspection: IP and domain reputation, greylisting, recipient verification, geolocation-based policy, SPF, DKIM and DMARC checks, plus third-party lists such as SURBL/RBL come into play here. The second layer is content analysis: digital signatures, keyword analysis together with its context, embedded URI inspection, PDF and image analysis, newsletter (greymail) detection and behavioural analysis all run at this stage. The third layer is malware detection: signature, heuristic and behavioural engines are used together with the FortiGuard virus outbreak protection service. The fourth layer is advanced threat protection: content disarm and reconstruction (CDR), cloud sandbox analysis, URL click protection and impersonation analysis operate at this point.

The intelligence feeding these engines comes from FortiGuard Labs. Fortinet states that FortiGuard Labs processes more than 100 billion events every day with artificial intelligence and machine learning systems (Fortinet, 2026); Fortinet's official data sheets also report that 1.8 million new definitions are produced weekly for the antivirus engine (Fortinet FortiSASE Data Sheet, 2026). On the independent testing side, Fortinet reports a 99.99% spam capture rate from Virus Bulletin in the FortiMail data sheet (Fortinet FortiMail Data Sheet); this is a result declared by Fortinet, and the year of the test is not stated in the data sheet. On the analyst side, Fortinet was positioned as a Challenger in the 2025 Gartner Magic Quadrant for Email Security (Fortinet, Gartner Magic Quadrants) — it is not a Leader in this category. Framing that distinction correctly puts product selection on realistic ground: FortiMail's strength is not the highest analyst rating on its own, but the fact that it operates on the same management plane as your Fortinet network and endpoint investment.

In which operating modes is FortiMail deployed?

FortiMail can be deployed in three classic operating modes (Gateway, Transparent, Server); in addition, it can run out of line with Microsoft and Google cloud email APIs without changing the MX record (Fortinet FortiMail Data Sheet, 2026). The choice of mode is determined by where your existing mail infrastructure sits and how much room to manoeuvre you have in DNS.

The deployment model is a separate decision: the same capabilities are delivered as a physical appliance, a virtual machine on a hypervisor (VMware, Citrix XenServer, Hyper-V, KVM), on major cloud platforms (AWS, Azure, Google Cloud, Oracle, AliCloud), or as FortiMail Cloud, where Fortinet takes on the operational responsibility. In projects with data residency obligations, hardware or a virtual machine in your own cloud comes to the fore, while the cloud model stands out for teams that do not want to carry the operational load. We clarify this choice together, based on your current mail volume, your disaster recovery expectations and your operating model within the scope of our DevOps and infrastructure services.

If we use Microsoft 365 or Google Workspace, do we need FortiMail?

It is not mandatory; however, risk concentrates when the built-in filter of the cloud mailbox remains the only layer. In this scenario FortiMail is positioned as a second, out-of-line inspection layer through the Microsoft and Google APIs without changing the MX record; with real-time and scheduled mailbox scanning, it can retract a message after it has already been delivered (Fortinet FortiMail Data Sheet, 2026).

The practical value of this capability is as follows: a phishing campaign may look clean in the first few minutes and be weaponised a few hours later. Because post-delivery clawback allows rules to be defined by keyword, file name or content type, the incident response team can clean up with a single policy instead of walking through mailboxes one by one. The overall tempo on the attacker's side points in the same direction: Fortinet's 2026 global threat landscape report states that the time to exploit for critical advisories has fallen to 24–48 hours and that global exploitation attempts increased by 25.49% year over year (Fortinet, 2026). That figure does not directly measure how quickly phishing links are weaponised; but it points to the same operational reality: a one-off decision taken at the moment of delivery can become invalid within hours. This is why post-delivery inspection makes a concrete difference compared with a single-layer filter.

In a cloud-mail-centric architecture, the alternatives must be evaluated openly. On the Microsoft 365 and Defender for Office 365 side, much of the protection is already embedded in your licence; as a third-party layer, Trend Micro email security solutions meet the same need. What distinguishes FortiMail is that the rest of the organisation's security investment sits on Fortinet and that email telemetry is collected within the same fabric. In organisations that run their own mail server, FortiMail is usually the direct first choice; the Gateway and Transparent modes provide deployment flexibility that cloud-only competitors do not offer.

How are BEC and phishing attacks detected in FortiMail?

BEC attacks usually contain no malicious attachment and no known malicious link; the attack consists of plain text wearing a trusted identity. For this reason FortiMail handles BEC not with signature matching but with identity and context checks.

How do impersonation and cousin domain detection work?

Multi-level anti-spoofing catches inconsistencies between the sender address and the display name. Impersonation analysis works for both manually defined and automatically learned executive and finance addresses. Cousin domain detection flags copies of your corporate domain with one or two characters changed — this is the main carrier of the classic "supplier IBAN change" scenario. When these three checks work together, even a payment instruction that contains no malicious payload can be classified as suspicious.

What happens on the link and file side?

URL click protection rewrites the links in a message and rescans the destination the moment the user clicks; this prevents an address that was clean at delivery time from being weaponised later. Content disarm and reconstruction (CDR) strips macros, active content and embedded add-ins from Office and PDF files and delivers a safe copy to the user; removing or rewriting hyperlinks in the HTML body is part of the same mechanism. For unknown files, cloud sandbox analysis comes into play, rescanning is performed at the moment of release from quarantine, and custom file hash lists can be defined. Isolation integration with FortiIsolator can also be set up to neutralise browser-based threats.

Are sender identity standards enforced?

Yes. FortiMail performs SPF, DKIM and DMARC validation on inbound mail and applies rejection or quarantine according to the DMARC policy; on outbound mail it signs messages, making it harder for your own domain to be impersonated. With DANE support, TLS enforcement on the receiving side can be validated. Moving DMARC from a "none" policy to a "reject" policy is usually a project in its own right: if that transition is made without taking an inventory of outbound mail sources, legitimate mail also starts to drop. That is why we have made running the transition through gradual reporting our standard way of working.

To what capacities does FortiMail scale?

FortiMail hardware models offer email routing capacity between 50,000 and 3.5 million messages per hour and manage between 20 and 2,000 protected email domains (Fortinet FortiMail Data Sheet, 2026). The table below summarises the tiers in the official data sheet.

It matters to know how these figures were measured. The data sheet values are based on an average message size of 100 KB, without queuing, and were tested with FortiMail 7.0; as FortiGuard antispam, virus outbreak protection and Enterprise ATP profiles are enabled, real capacity drops step by step. When working with cloud email API integration, a separate and lower performance table applies (Fortinet FortiMail Data Sheet, 2026). Model selection must therefore be based not only on user count, but on your real message volume at peak hours and on the profiles you plan to enable. The virtual machine versions offer the same feature set and scale according to the number of virtual cores assigned; in branch or test environments, a virtual deployment is often preferred over hardware. For correct sizing we review the last 12 months of statistics from your current mail gateway together, and then produce a configuration recommendation specific to the project.

On the continuity side, FortiMail supports high availability in all deployment scenarios: active-passive mode and active-active configuration synchronisation, quarantine and mail queue synchronisation, device failure detection and redundant interface support are all available. In practice, a mail gateway going down means the organisation's communication with the outside world going down; for that reason we recommend single-appliance deployments only in genuinely small environments. On the storage side, hardware or software RAID can be configured depending on the model and drive count, and external storage servers and iSCSI targets can be used.

How does FortiMail contribute to KVKK and PCI-DSS compliance?

FortiMail does not grant a compliance certificate on its own; however, it directly meets a portion of the technical measures that regulations explicitly require: gateway-level filtering, data loss prevention, encryption, archiving and log recording.

Which measures does it correspond to on the KVKK side?

In the publication titled Personal Data Security Guide (Technical and Administrative Measures) by Turkey's Personal Data Protection Authority (KVKK), it is stated that firewalls and gateways are the primary measures for protecting information technology systems containing personal data against unauthorised access threats arriving over the internet, and that they constitute the first line of defence (KVKK, January 2018). In the same guide's summary table of technical measures, data loss prevention software, encryption, log records and up-to-date anti-virus systems are listed as separate items. FortiMail produces the email-channel equivalent of these items: DLP with file fingerprinting and sensitive data detection, server-to-server TLS together with S/MIME and identity-based encryption (IBE) that requires no client installation on the recipient side, detailed message tracking and comprehensive event logging. The point that helps most in practice is writing DLP rules according to the organisation's own vocabulary: unless patterns are defined for fields such as national ID numbers, IBANs or patient file numbers, DLP produces nothing but noise.

How are PCI-DSS and archiving requirements met?

PCI DSS v4.0 requires network security controls (NSCs) to be enforced between trusted and untrusted networks and the configurations of these controls to be reviewed at least once every six months (PCI SSC, PCI DSS v4.0). The email gateway is not outside this scope; DLP policies that prevent cardholder data from leaving via email in particular constitute concrete evidence during audits. Policy-based email archiving and Exchange journal archiving support are used in financial and healthcare organisations with retention obligations. On the log centralisation side, FortiMail exports its events to FortiAnalyzer; FortiAnalyzer offers out-of-the-box compliance reports such as PCI-DSS and HIPAA and provides forensic data with 500,000 IOCs per day via the FortiGuard IOC service (Fortinet FortiAnalyzer Data Sheet, 2026).

How does FortiMail connect to the Fortinet Security Fabric and how is the project run?

FortiMail is positioned not as an isolated box but as the email arm of the Security Fabric. Indicators of compromise (IOCs) and telemetry are shared within the fabric; a domain seen in a phishing message that reaches one user can therefore also be blocked at the network and endpoint layers. Fortinet states that the Security Fabric provides unified visibility across an ecosystem covering more than 500 third-party solutions in addition to its own products (Fortinet, 2026).

In practice the connections we build most often are these: joint blocking at the network layer with the FortiGate firewall, centralised logging and reporting with FortiAnalyzer, behavioural detection of a malicious file executed on the endpoint with FortiEDR, and consistent policy on the user device with FortiClient. If the traffic of remote workers passes through FortiSASE, the web and email layers are fed by the same intelligence. If you have internet-facing web applications, deploying alongside FortiWeb makes it harder for credentials harvested from phishing pages to be used against your applications. For the full portfolio and how the components connect to one another, see our Fortinet solutions page.

How is a migration project planned?

A typical FortiMail migration runs in four stages. First, inventory: the domains to be protected, outbound mail sources, application servers and the last 12 months' volume profile of the existing gateway are documented. Then parallel operation: FortiMail is brought online, policies are run in monitor mode and false positives are reviewed together with DMARC reports. In the third stage the cutover takes place; the MX record is changed or the API integration is enabled, and quarantine and end-user notifications are activated. The final stage is hardening: CDR, URL click protection, impersonation analysis and DLP policies are enabled gradually. This staged approach is the safest way to raise the protection level without generating user complaints.

What should be expected on the licensing and operations side?

FortiMail's feature sets are offered as packages. The base package includes multi-layered spam and malware detection, LDAP integration, secure delivery with TLS, message tracking, identity-based encryption and email DLP. The Enterprise ATP package adds CDR, URL click protection, impersonation analysis and cloud sandbox on top of these. The package with cloud email API support covers real-time and scheduled scanning of Microsoft and Google mailboxes together with post-delivery clawback. Which package you need depends on whether you use cloud mail and on your BEC risk profile. As a Fortinet authorised channel partner, we take on licensing, deployment, migration and the managed service side; because pricing varies by model, package and contract term, request a quote and let us size it together.

Email security is not the work of a single product but of correct positioning: the choice of mode, the DMARC transition, writing DLP policies according to the organisation's own vocabulary, and establishing the fabric connections determine the outcome. Let us review your current mail infrastructure and volume and produce the right model, package and deployment recommendation for FortiMail; get in touch with us for installation, migration and managed service options, or explore our other enterprise solutions.