Resolving FortiMail DMARC Quarantine for Legitimate Third-Party Emails
A company uses FortiMail to protect email. They set up DMARC with a policy of 'quarantine' for emails failing SPF and DKIM checks. However, legitimate emails from a third-party service are being quarantined. What should the admin do?
Quick Answer
The correct answer is to update the SPF record to include the third-party mail server IP. This resolves the issue because DMARC alignment requires that the domain in the envelope sender (Return-Path) matches the domain in the From header, and when a third-party service sends email on your behalf, its IPs are not authorized in your SPF record, causing SPF failure and triggering the quarantine policy. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding of how DMARC interacts with SPF and DKIM—a common trap is assuming you should lower the DMARC policy to "none," but the correct approach is to authorize the legitimate sender. A quick memory tip: "SPF first, DKIM second—authorize the sender before relaxing the policy."
⚠ Common exam trap
A common mix-up: candidates think whitelisting or disabling DMARC is the quick fix, but the exam tests understanding that DMARC enforcement is based on SPF/DKIM alignment, so the correct solution is to authorize the legitimate sender in the SPF record.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the SPF record to include the third-party mail server IP
The root cause is that the third-party mail server's IP is not authorized in the sender domain's SPF record. DMARC uses SPF alignment: if the message fails SPF (because the sending IP is not listed) and also fails DKIM, DMARC enforces the 'quarantine' policy. Adding the third-party IP to the SPF record allows SPF to pass, achieving alignment and preventing quarantine.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add the sender domain to a whitelist in FortiMail
Why it's wrong here
Whitelisting bypasses all checks, which may be too permissive.
- ✗
Change the DMARC policy to 'none'
Why it's wrong here
Setting to 'none' removes protection against spoofing.
- ✗
Disable DMARC checking for that specific sender
Why it's wrong here
Disabling for a sender weakens security.
- ✓
Update the SPF record to include the third-party mail server IP
Why this is correct
Adding the IP to SPF allows the service to pass SPF check, reducing false quarantines.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses FortiMail for email security. They want to prevent email spoofing by verifying that incoming emails originate from authorized servers. Which email authentication method should be configured on FortiMail to check the sending server's IP against a published SPF record?
medium- ✓ A.SPF verification
- B.DKIM verification
- C.DMARC verification
- D.Sender Policy Framework (SPF) is not supported on FortiMail
Why A: SPF (Sender Policy Framework) verification on FortiMail checks the sending server's IP address against the SPF record published in the domain's DNS. This directly matches the requirement to verify that incoming emails originate from authorized servers, as SPF is designed to prevent spoofing by validating the envelope sender's domain against a list of permitted IPs.
Variation 2. A company uses FortiMail and wants to ensure that incoming emails are authenticated using SPF, DKIM, and DMARC. Which profile should the administrator configure to enforce these checks?
medium- A.Session Profile
- B.Antispam Profile
- C.IP Policy
- ✓ D.Authentication Profile
Why D: The Authentication Profile in FortiMail is specifically designed to enforce email authentication checks such as SPF, DKIM, and DMARC. This profile defines the actions to take when an email fails these authentication checks, such as quarantining or rejecting the message, and is applied to incoming email flows to ensure compliance with authentication standards.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.