spamfilter : bword
 
bword
Use this command to add or edit and configure options for the email filter banned word list.
The FortiGate email filters are applied in the following order:
For SMTP
1. IP address BWL check - Last hop IP
2. DNSBL & ORDBL check, IP address FortiGuard check, HELO DNS lookup
3. E-mail address BWL check
4. MIME headers check
5. IP address BWL check (for IPs extracted from “Received” headers)
6. Return e-mail DNS check, FortiGuard Antispam check (for IPs extracted from “Received” headers, and URLs in email content)
7. Banned word check
For POP3 and IMAP
1. E-mail address BWL check
2. MIME headers check, IP BWL check
3. Return e-mail DNS check, FortiGuard Antispam check, DNSBL & ORDBL check
4. Banned word check
For SMTP, POP3, and IMAP
Control spam by blocking email messages containing specific words or patterns. If enabled, the FortiGate unit searches for words or patterns in email messages. If matches are found, values assigned to the words are totalled. If a user-defined threshold value is exceeded, the message is marked as spam. If no match is found, the email message is passed along to the next filter.
Use Perl regular expressions or wildcards to add banned word patterns to the list. Add one or more banned words to sort email containing those words in the email subject, body, or both. Words can be marked as spam or clear. Banned words can be one word or a phrase up to 127 characters long.
If a single word is entered, the FortiGate unit blocks all email that contain that word. If a phrase is entered, the FortiGate unit blocks all email containing the exact phrase. To block any word in a phrase, use Perl regular expressions.
 
Perl regular expression patterns are case sensitive for email filter banned words. To make a word or phrase case insensitive, use the regular expression /i. For example, /bad language/i blocks all instances of bad language regardless of case. Wildcard patterns are not case sensitive.
Syntax
config spamfilter bword
edit <list_int>
set name <list_str>
set comment <comment_str>
config entries
edit <banned_word_int>
set action {clear | spam}
set language {french | japanese | korean | simch | spanish | thai | trach | western}
set pattern <banned_word_str>
set pattern-type {regexp | wildcard}
set score <int>
set status {enable | disable}
set where {all | body | subject}
end
Variable
Description
Default
<list_int>
A unique number to identify the banned word list.
 
<list_str>
The name of the banned word list.
 
<comment_str>
The comment attached to the banned word list.
 
<banned_word_int>
A unique number to identify the banned word or pattern.
 
action {clear | spam}
Enter clear to allow the email. Enter spam to apply the spam action.
spam
language {french | japanese | korean | simch | spanish | thai | trach | western}
Enter the language character set used for the banned word or phrase. Choose from French, Japanese, Korean, Simplified Chinese, Thai, Traditional Chinese, or Western.
western
pattern <banned_word_str>
Enter the banned word or phrase pattern using regular expressions or wildcards.
No default.
pattern-type {regexp | wildcard}
Enter the pattern type for the banned word (pattern). Choose from regular expressions or wildcard.
wildcard
score <int>
A numerical weighting applied to the banned word. The score values of all the matching words appearing in an email message are added, and if the total is greater than the spamwordthreshold value, the message is processed according to the spam action setting. The score for a banned word is counted once even if the word appears multiple times in an email message.
10
status {enable | disable}
Enable or disable scanning email for each banned word.
enable
where {all | body | subject}
Enter where in the email to search for the banned word or phrase.
all