Relaying using FortiMail’s built-in MTA versus unprotected SMTP servers
When not proxying, FortiMail units can use their own built-in SMTP relay to deliver email.
If an email user at the branch office, behind a FortiMail unit, specifies the unprotected SMTP server 10.0.0.1 as the outgoing SMTP server, you can either let the email user send email using that specified unprotected SMTP server, or ignore the client’s specification and insist that the FortiMail unit send the email message itself.
• If you permit the client to specify an unprotected SMTP server, the FortiMail unit will allow the email client to connect to it, and will not act as a formal relay. If the client’s attempt fails, the outgoing proxy will simply drop the connection and will not queue the email or retry.
• If you insist that the client relay email using the FortiMail unit’s built-in MTA rather than the client-specified relay, the FortiMail unit will act as an MTA, queuing email for temporary delivery failures and sending error messages back to the email senders for permanent delivery failures. It may also reroute the connection through another relay server, or by performing an MX lookup of the recipient’s domain, and delivering the email directly to that mail gateway instead.
Enabling the FortiMail unit to allow clients to connect to unprotected SMTP servers may be useful if, for example, you are an Internet service provider (ISP) and allow customers to use the SMTP servers of their own choice, but do not want to spend resources to maintain SMTP connections and queues to external SMTP servers.
Unlike the outgoing proxy, the incoming proxy does queue and retry. In this way, it is similar to the built-in MTA.
For information on configuring use of the incoming proxy or outgoing proxy instead of using the built-in MTA, see
“Use client-specified SMTP server to send email” (for outgoing connections) and
“Use this domain’s SMTP server to deliver the mail” (for incoming connections containing outgoing email messages).