FortiMail

Why do you need FortiMail?

Email security is the cybersecurity control that has to be wrong in the least damaging direction: a blocked invoice costs an afternoon, a delivered impersonation costs the transfer. Where the decision is made — at the gateway or inside the mailbox — decides what evidence the filter has to work with.

Email is the one channel where a stranger can address your employee with no preparation at all. A Business Email Compromise (BEC) attack does not need a malicious attachment — a convincingly spoofed message is enough.

FortiMail is an email protection platform with machine-learning detection that protects against spam, phishing, BEC, impersonation, malware and zero-day threats. A sandbox analyzes attachments, and API integration with Microsoft 365 and Google Workspace complements the built-in protection of these services.

How does it work?

Phishing Protection

Multi-layered phishing detection:

• Machine learning, behavior analysis and outbreak protection against new campaigns
• URL rewriting and rescanning at the time of click
• Detection of lookalike (cousin) domains
• FortiGuard URL filtering, including newly registered domains
• Protection against zero-day threats

Business Email Compromise Protection

Protection against fraud:

• Multi-level anti-spoofing protection
• Domain authentication (SPF, DKIM, DMARC)
• Behavior and anomaly analysis
• Manual and automatic address impersonation detection

Advanced Threat Protection

Defense against unknown malware:

• Cloud sandboxing and FortiSandbox integration
• Content Disarm & Reconstruction (CDR)
• FortiGuard threat intelligence
• Attachment analysis, including PDF and Office documents
• Removal of macros and active content from documents

Key Features

Inbound Protection

• Multi-layered anti-spam (reputation, authentication, content)
• Multi-layered malware detection
• URL analysis and sandboxing
• Attachment filtering
• Centralized quarantine

Outbound Security

• DLP (Data Loss Prevention)
• Sensitive data detection (finance, healthcare, personal data)
• TLS encryption enforcement
• Control of outbound email from compromised devices

Email Encryption

• Server-to-server TLS with cipher suite control
• Identity-Based Encryption (IBE) with no software required at the recipient
• S/MIME
• Optional Outlook plugin for IBE encryption

Archiving & Compliance

• Email archiving with external storage
• Exchange journal archiving
• Message tracking
• Logging and reporting (optionally FortiAnalyzer)

Deployment Models

FortiMail runs as an appliance (several performance classes), a virtual machine (VMware, Citrix XenServer, Hyper-V, KVM; AWS, Azure, Google Cloud, Oracle, AliCloud) or the FortiMail Cloud service. Operation modes:

• Gateway — an MX record change directs email to FortiMail, which relays safe messages onward
• Microsoft and Google API — no MX change, with mailbox scanning and post-delivery clawback
• Transparent — no change to the MX record or mail server configuration (not available with FortiMail Cloud)
• Server — a full mail server with POP3, IMAP and webmail

FortiMail Cloud: a SaaS service — Fortinet manages the infrastructure

Cloud Email Integration

Microsoft 365:

• API-based integration
• Gateway (inline) mode
• Real-time and scheduled mailbox scanning
• Impersonation protection

Google Workspace:

• API-based integration
• Real-time scanning
• Gmail protection
• Post-delivery clawback

Who is it for?

• Organizations needing advanced email protection
• Organizations with Microsoft 365 or Google Workspace
• Organizations that must control data sent by email
• Organizations where finance teams and management approve payments based on email

Benefits

For IT: multiple deployment models, API integration with M365/Google, central management

For security: machine-learning phishing detection, BEC protection, sandboxing

For business: email continuity (Email Continuity in FortiMail Cloud), control of outbound data

Specifications

Anti-spam	FortiGuard, reputation, SPF/DKIM/DMARC
Phishing detection	AI/ML powered
ATP	Sandbox, CDR, FortiSandbox
Deployment	Appliance, VM, Cloud, M365/Google

When does FortiMail make sense in your organization?

Email protection works in both directions: it stops what comes in and controls what goes out. Three typical situations in which FortiMail answers a specific problem:

Email as a channel for phishing and data leaks

In a financial institution, email is at the same time the way in for phishing and BEC and the way out for customer data — often by mistake rather than malice. According to the 2025 Data Security Report (Fortinet and Cybersecurity Insiders, a survey of 883 IT and cybersecurity professionals), 49% of organizations report a data loss incident caused by negligent employees, while only 16% report one involving confirmed malicious intent, and 46% of respondents use email DLP. FortiMail detects financial, medical and personal data in outbound email, recognizes documents by fingerprint and encrypts messages with IBE, without installing software at the recipient. Fortinet addresses data protection beyond email — on devices and in cloud applications — with a separate product, FortiDLP. Figures from the 2025 Data Security Report (Fortinet, Cybersecurity Insiders).

Microsoft 365 and Google Workspace

An organization in the cloud does not want to change its MX record. In API mode, FortiMail connects to Microsoft 365 or Google Workspace, scans mailboxes in real time and on a schedule, and can claw back a message identified as malicious only after delivery. The vendor describes this mode as a complement to the built-in protection of Microsoft 365 and Google Workspace, not a replacement. The FortiMail Workspace Security suite extends protection to browsers and collaboration tools such as Teams, Slack, OneDrive or Dropbox, and includes a managed incident response service.

Email under the control of the compliance team

The compliance team needs an answer to the question of who sent what to whom. FortiMail tracks messages, archives email (including the Exchange journal) and forwards logs to FortiAnalyzer, and administration can be split by domain and role. Access to the quarantine and webmail can go through SAML 2.0 SSO or ADFS, and configuration changes and incidents are logged.

Why deploy FortiMail with nFlo?

No filter will stop every message, which is why email protection works best together with people who recognize a suspicious email. In a FortiMail project, the nFlo team:

• inventories domains, mail flows and existing protection mechanisms,
• designs the operation mode (gateway or API) and the DLP and encryption policies,
• deploys FortiMail in stages, starting with selected domains,
• maintains the policies and reviews the quarantines.

We test employee resilience in the Phishing Simulations service. Start a conversation about email protection in your organization through contact; you can read about nFlo’s cooperation with the vendor on the Fortinet page.

FAQ

Does FortiMail replace native M365 filters? It does not have to. In API mode, FortiMail works alongside the built-in mechanisms of Microsoft 365 and Google Workspace and complements them: it scans mailboxes and claws back messages after delivery. In gateway mode, it takes over filtering in front of the mail server.

How does FortiSandbox integration work? Suspicious attachments go to the cloud sandbox (in bundles with ATP) or to FortiSandbox, and FortiMail shares indicators of compromise with the Security Fabric. A message released from quarantine is rescanned.

What is BEC protection? Protection against Business Email Compromise: multi-level anti-spoofing protection, address impersonation analysis and detection of domains that look deceptively similar to yours.

Does it support email encryption? Yes. Server-to-server TLS with optional enforcement, S/MIME and Identity-Based Encryption (IBE) with no software required at the recipient; IBE encryption can be triggered by an Outlook plugin.

How does M365 integration work? Via API (no MX change) or via MX record redirection. In API mode, FortiMail scans mailboxes in real time and on a schedule and claws back messages after delivery.

What is CDR? Content Disarm & Reconstruction — removing macros and active content from Office and PDF documents and links from HTML content, so that the message arrives without dangerous elements.

Is archiving available? Yes. Email archiving with external storage and support for Exchange journal archiving.

How does DLP work? Detection of sensitive data (finance, healthcare, personal data), fingerprinting of documents from Windows file shares or manually uploaded files, and automatic decryption of archives and password-protected documents using the administrator’s password list.

Does FortiMail work as SaaS? Yes. FortiMail Cloud is a service in which Fortinet manages the infrastructure; an Email Continuity add-on is also available for email outages.

How does support work? nFlo, as a Fortinet Advocate Partner, deploys FortiMail and tunes email protection policies. Issues that require the vendor are escalated to Fortinet technical support.

Does FortiMail protect against a click on a link that became malicious after delivery? Yes. URL Click Protect rewrites URLs in messages and rescans them at the time of click, and in API mode a message later identified as malicious can be clawed back from mailboxes.

What is FortiMail Workspace Security? It is a suite of FortiMail Cloud SaaS (cloud email protection), Browser Security and Collaboration Security for tools such as Teams, Slack, OneDrive or Dropbox, with a managed incident response service.

Can FortiMail handle multiple domains and branches? Yes. FortiMail supports multiple email domains with per-domain settings, role-based and per-domain administration, and high availability in active-passive or active-active mode.