Local mail server security
A government organization runs Exchange on-prem; FortiMail in gateway mode handles inbound/outbound protection.
Fortinet · Network Security and SD-WAN
FortiMail
AI-driven enterprise email security gateway.
Quick answer
FortiMail is Fortinet's email security gateway that runs on-prem, hybrid or in the cloud. It offers AI-based phishing/BEC detection, FortiSandbox-integrated file analysis, DMARC enforcement and DLP. Preferred for organizations running their own mail servers.
FortiMail is the primary email security choice for organizations whose mail servers are not M365 or Google Workspace (e.g., on-prem Exchange, postfix).
When the MX record is routed to FortiMail, inbound traffic is filtered; outbound traffic is signed via DMARC/DKIM. All modes (gateway, server, transparent) are supported.
FortiGuard threat intelligence, FortiSandbox file detonation, IP reputation and behavioral AI deliver a spam/phishing detection rate close to 99.9%.
Key features
What it offers
- AI-driven phishing and BEC detection
- Integrated FortiSandbox file analysis
- DMARC, DKIM, SPF orchestration
- DLP and email encryption
- On-prem, hybrid or SaaS
- Outbound DMARC enforcement
- Identity-Based Encryption (IBE)
- Multi-tenant (multi-tenant)
Tech Summary
Important technical data
- Mode
- Gateway, server, transparent
- Hardware
- FortiMail 60F → 3000E models
- Cloud
- FortiMail Cloud (SaaS)
- Virtual
- VMware, Hyper-V, KVM, AWS, Azure VM
- Licensing
- Per user or mailbox
- MTA throughput
- 5K → 1M emails/hour
Use CasesGovernment Hospital Manufacturing Education
When would you choose this product?
DLP for patient-data emails
A hospital uses FortiMail DLP policies to automatically encrypt emails containing national-ID numbers and to log them.
Block supplier BEC attacks
A factory uses FortiMail's Impersonation Protection to block BEC attacks impersonating suppliers.
University email filtering
A university protects 30,000 student emails in front of an on-prem Exchange with FortiMail.
Who is it for?
Organizations with their own email infrastructure; on-prem Exchange users.
Frequently Asked Questions
Frequently asked questions
Do I need FortiMail with M365?
M365 includes Exchange Online Protection (EOP); for an extra layer, Defender for O365 or Trend Email Security is a better fit. FortiMail is typically for organizations with on-prem mail servers.
Difference between gateway and server modes?
Gateway: MTA that filters inbound/outbound. Server: full email server — MTA + mailbox storage. Transparent: sniffs SMTP traffic on the network without an MX change.
How does DMARC enforcement work?
In outbound mode FortiMail signs with DMARC/DKIM/SPF; in inbound it checks DMARC compliance and rejects or quarantines per policy.
Is FortiSandbox required?
No, but recommended. FortiMail's built-in sandbox is limited; for real behavioral analysis of unknown files, add FortiSandbox — as a separate appliance or cloud service.
Is the license per user or per mailbox?
Typically per protected mailbox count. Distribution lists and shared mailboxes don't consume licenses. There is a separate SKU for outbound MTA.
How does email encryption (IBE) work?
Identity-Based Encryption: the recipient can open the encrypted email without prior registration; the recipient email address is the key. S/MIME and PGP are also supported.
Are DLP policies KVKK-compliant?
Yes. National ID, IBAN, credit card, phone and email regex patterns + content classification + file fingerprinting cover KVKK compliance.
Are HA and cluster supported?
Yes. Active-passive HA cluster is critical for email redundancy. Active-active load balancing uses a load balancer (FortiADC) in front of 2+ FortiMail units.
Can logs be sent to FortiAnalyzer?
Yes. FortiMail syslogs all SMTP events and filter actions to FortiAnalyzer for centralized reporting.
Does it archive old emails?
Yes — an email archive module stores all sent and received emails for years. Used in regulated sectors such as SOX and MiFID.
Vendor's official product page
Opens the vendor's original technical documentation and product page in a new tab.
Fortinet — FortiMail →From the same brand
Fortinet family — other products
FortiGate NGFW
AI-driven Next-Gen Firewall family (40F → 7081F).
DetailsFortiSASE
Cloud-delivered Secure Access Service Edge for hybrid workers.
DetailsFortiClient (ZTNA + EPP)
One agent for VPN, ZTNA, EDR and compliance.
DetailsFortiEDR / FortiXDR
Endpoint Detection & Response and extended detection/response.
DetailsComparable Solutions
Similar solutions from other brands
FortiMail licensing + deployment + support
Sora Yazılım handles licensing, deployment, training and ongoing management — all from a single team.