Configuring SPF, DKIM, and DMARC in FortiMail for Email Authentication and Quarantine
A security team is configuring FortiMail for email security. They want to ensure that incoming emails are authenticated using SPF, DKIM, and DMARC, and that emails failing authentication are quarantined. Which THREE settings must be configured in FortiMail? (Choose three.)
Quick Answer
The answer is that you must enable SPF verification, DKIM verification, and DMARC verification within the anti-spam policy in FortiMail. These three settings are required because email authentication relies on a chain of checks: SPF validates the sending server’s IP against the domain’s DNS record, DKIM verifies the cryptographic signature on the email header, and DMARC uses the results of both to determine how to handle failures—such as quarantining the message. On the Fortinet NSE 7 Advanced Security NSE7 exam, this question tests your understanding that all three verifications must be explicitly toggled on in the anti-spam policy, not just enabled globally; a common trap is assuming that enabling DMARC alone automatically activates SPF and DKIM checks. Remember the mnemonic “SDQ” for SPF, DKIM, and Quarantine—each must be individually switched on in the policy to enforce the full authentication flow.
⚠ Common exam trap
Test-takers frequently confuse transport security (TLS) with email authentication protocols, mistakenly thinking TLS is required for SPF/DKIM/DMARC enforcement, when in fact TLS is optional and unrelated to the authentication chain.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable DKIM verification in the anti-spam policy
DKIM verification must be explicitly enabled in the anti-spam policy to allow FortiMail to validate the DKIM signature on incoming emails. Without this setting, DKIM authentication is not performed, and the email's DKIM status will not be evaluated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable DKIM verification in the anti-spam policy
Why this is correct
DKIM verification must be enabled to verify DKIM signatures.
- ✗
Enable TLS encryption for incoming SMTP
Why it's wrong here
TLS encryption for incoming SMTP secures the transmission channel between mail servers but does not perform any authentication of the sender’s identity via SPF, DKIM, or DMARC, nor does it trigger quarantine actions for failing those checks. It is tempting because encrypting SMTP traffic is a common security practice for protecting email content in transit, and in a scenario requiring confidentiality and integrity of message delivery, enabling TLS would be the correct choice.
- ✓
Enable DMARC verification and set the action for DMARC failure to quarantine
Why this is correct
DMARC verification must be enabled and action set to quarantine.
- ✓
Enable SPF verification in the anti-spam policy
Why this is correct
SPF verification must be enabled to check SPF records.
- ✗
Configure a recipient verification policy
Why it's wrong here
Recipient verification is separate from authentication.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization uses FortiMail and wants to validate that incoming emails are from legitimate senders by checking the sender's domain against a published policy. Which two email authentication mechanisms can FortiMail use? (Choose two.)
medium- A.DKIM and DMARC
- B.STARTTLS and SPF
- C.DMARC and SPF
- ✓ D.SPF and DKIM
Why D: FortiMail can use SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to validate that incoming emails originate from legitimate senders by checking the sender's domain against a published policy. SPF verifies that the sending IP address is authorized by the domain's DNS TXT record, while DKIM uses a digital signature in the email header that can be validated against a public key published in the sender's DNS. Both mechanisms allow FortiMail to authenticate the sender's domain before accepting the message.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.