FortiMail Virtual Series is a family of virtual email-security appliances for organisations that want administrative control over the FortiMail platform without deploying a dedicated FortiMail hardware appliance. It is mainly used to inspect and control inbound and outbound email, apply anti-spam and anti-malware protections, support data-protection policies, and provide visibility into email threats. Businesses running supported hypervisors or public-cloud infrastructure should consider it when a self-managed virtual deployment fits their architecture. Before proceeding, buyers should confirm the correct VM size, protected-domain requirement, email workload, CPU and memory allocation, storage, virtual networking, licensing bundle, optional services, cloud or hypervisor compatibility, and whether gateway, transparent, server or API-assisted operation is appropriate.
What the FortiMail Virtual Series does
The virtual series places FortiMail email-security controls inside a virtual machine rather than a dedicated appliance. Fortinet positions the VM range for private-cloud, public-cloud and virtualised data-centre use where the organisation wants control of the infrastructure and the email-security configuration. Depending on the selected services and policy design, FortiMail can inspect email for spam, malicious content, phishing indicators, impersonation attempts and other message-borne threats while also supporting mail handling, reporting, quarantine and data-protection functions.
This distinction matters during procurement. A virtual appliance is not simply a software download with unlimited capacity. Each licensed VM tier has defined resource limits and sizing characteristics, and the allocated virtual CPU and memory must stay within the entitlement. The surrounding infrastructure—hypervisor, storage performance, virtual networking, DNS, routing and mail-server integration—also becomes part of the deployment design.
Who should consider a virtual FortiMail deployment?
The series can be a good fit for IT teams that already operate virtual infrastructure and want email security to follow the same compute, backup, change-control and data-centre practices as other workloads. It is also relevant to organisations building private-cloud environments, moving selected security services to public cloud, or standardising security functions across multiple virtual locations.
A virtual appliance is less attractive when the business does not want responsibility for the underlying infrastructure or would prefer a provider-hosted service. In that situation, FortiMail Cloud may deserve comparison. The correct choice is therefore not only about security features; it is also about who will operate the VM, patch the surrounding platform, manage capacity, maintain routing and DNS, and own the operational response when mail flow is disrupted.
Business challenges the virtual series can help address
Unsafe inbound email
Phishing, malicious attachments, suspicious links, impersonation and bulk spam can reach users through the mail channel. FortiMail uses layered inspection and FortiGuard services to reduce this exposure, with the exact protection set depending on the selected bundle and enabled services.
Outbound data exposure
Email can also be a path for accidental or inappropriate transmission of sensitive data. FortiMail includes data-loss-prevention and encryption capabilities, although policy scope, feature entitlement and organisational requirements must be reviewed before they are treated as part of a compliance design.
Rigid hardware placement
Some organisations want email security to run wherever their virtual workloads run. A VM form factor can support this architectural flexibility, subject to supported platform, resource, network and licensing conditions.
Growth without a chassis swap
The VM01-to-VM32 family provides different resource ceilings and protected-domain scales. Growth still requires correct licensing and resources, but virtual sizing can offer a different lifecycle path from replacing a physical appliance.
Core capabilities buyers should evaluate
FortiMail Virtual Series fit matrix
| Requirement | Suitable when | Confirm before ordering |
|---|---|---|
| Virtual data-centre deployment | The organisation already operates a supported virtualisation platform and wants to manage FortiMail itself. | Hypervisor version, VM package, resource entitlement, network interfaces and storage. |
| Public-cloud security workload | The mail-security control plane should be hosted in a supported cloud environment. | Cloud platform, BYOL/subscription path, network design, egress costs and high-availability architecture. |
| Multiple protected domains | The selected VM tier provides an appropriate domain limit for the current and projected environment. | Primary domains, associated domains, tenant model and any advanced-management requirement. |
| Microsoft 365 or Google Workspace integration | The buyer wants gateway protection and, where applicable, API-level functions. | Exact API integration entitlement, supported configuration and desired post-delivery controls. |
| Managed-service use | The service provider needs multi-tenant administration and appropriate scale. | Advanced Administration/MSSP licensing, domain structure, operational responsibilities and capacity. |
Current FortiMail virtual-appliance family information
Fortinet’s current FortiMail documentation lists six virtual-machine options. The figures below are family-level planning data, not a promise of real-world throughput. Actual performance depends on hardware, enabled inspection, message characteristics, infrastructure and configuration. Buyers should size from their own mail profile rather than choosing only from a headline message-per-hour figure.
| Model | Max vCPU | Virtual NICs min/max | Storage min/max | Memory min/max | Protected domains* | Typical positioning |
|---|---|---|---|---|---|---|
| VM01 | 1 | 1 / 4 | 250 GB / 1 TB | 2 GB / 4 GB | 20 | Small business, branch or smaller organisation |
| VM02 | 2 | 1 / 4 | 250 GB / 2 TB | 2 GB / 8 GB | 70 | Small to midsized organisation |
| VM04 | 4 | 1 / 6 | 250 GB / 4 TB | 4 GB / 16 GB | 500 | Mid to large enterprise |
| VM08 | 8 | 1 / 6 | 250 GB / 8 TB | 4 GB / 64 GB | 1,000 | Large enterprise |
| VM16 | 16 | 1 / 6 | 250 GB / 12 TB | 4 GB / 128 GB | 1,500 | Large enterprise |
| VM32 | 32 | 1 / 6 | 250 GB / 24 TB | 4 GB / 128 GB | 2,000 | Large enterprise and high-scale environments |
*Protected-domain limits and capabilities can be affected by current licensing and advanced-management options. Confirm the current Fortinet ordering guide for the exact bill of materials.
Licensing, resources and compatibility are part of the product decision
FortiMail VM licensing is not separate from virtual-machine sizing. Fortinet documents that a VM license unlocks resource limits such as the maximum number of virtual CPUs and memory. Allocating CPU or memory beyond the licensed limit can invalidate the VM license, so infrastructure teams should not treat resource changes as routine hypervisor adjustments without checking entitlement. Current ordering guidance also distinguishes perpetual VM licensing from S-series subscription licensing, with additional functionality available through bundles or add-ons.
Compatibility should also be validated against the current Fortinet release and installation guide. Fortinet’s published virtual-appliance information includes VMware, Hyper-V, Citrix XenServer, KVM and several public-cloud environments, but platform versions and deployment methods can change. Confirm the intended platform and version at quotation time, especially where an existing virtualisation standard, cloud marketplace image, BYOL process or high-availability design is involved.
A practical purchase and deployment journey
Map the mail environment
Document mail platforms, domains, average and peak mail volume, user count, routing, inbound and outbound flows, business-critical relays, and any existing security gateway.
Choose architecture
Decide whether FortiMail will operate in a private data centre, supported public cloud or another approved virtual environment and how it will sit in the mail path.
Size the VM tier
Compare domain limits, vCPU entitlement, memory, storage and expected inspection load. Leave room for realistic growth rather than sizing only to the current average.
Build the license scope
Confirm Base or Enterprise ATP services, support, API integration, continuity, advanced administration or other add-ons that are required rather than assuming all capabilities are standard.
Plan implementation
Prepare DNS, routing, certificates, connectors, policy migration, change windows, test messages, rollback steps and administrator access before production cutover.
Sizing for real mail flow, not only mailbox count
Mailbox count is useful context, but it is not enough to size an email-security gateway. Two organisations with the same number of mailboxes can produce very different loads because of message frequency, attachment sizes, automated systems, distribution lists, newsletters, business applications and external-facing services. Inspection depth also matters. Anti-spam and antivirus processing, sandbox submission, URL analysis, content disarm, DLP and reporting can influence compute, storage and operational behaviour.
A better sizing conversation starts with average and peak messages per hour, message size profile, number of protected domains, expected retention or quarantine behaviour, outbound relays and forecast growth. Where the deployment supports a critical mail path, resilience and failover design should be considered at the same time as VM size rather than added after purchase.
Management and Security Fabric integration
FortiMail provides dashboards, reports, quarantine and mail-handling controls intended to give administrators visibility into email traffic and detected threats. It can also participate in the wider Fortinet Security Fabric, sharing indicators and working with Fortinet products such as FortiSandbox, FortiAnalyzer, FortiSIEM or FortiSOAR where the corresponding product, integration and licensing requirements are met.
For a buyer, the practical question is how much integration is useful. An organisation with an established Fortinet security stack may value consolidated event visibility and response workflows. A mixed-vendor environment can still use FortiMail, but API, logging and operational ownership should be defined so security events are not duplicated or lost between tools.
Deployment modes change the integration work
FortiMail supports more than one operating model. Gateway mode places the system in the SMTP path and normally involves mail-routing and MX considerations. Transparent mode can reduce certain DNS or server changes by bridging traffic, while server mode allows FortiMail to act as a messaging server in defined scenarios. API integration for supported cloud email services offers another approach for selected functions and can support post-delivery actions.
These modes are not interchangeable shortcuts. Each has different network, resilience, troubleshooting and change-management consequences. The chosen architecture should reflect the organisation’s mail platform, security objective, tolerance for MX changes, internal-mail visibility requirements and available license options.
Where the FortiMail Virtual Series fits well
Virtualised enterprise data centres
Businesses that already standardise workloads on supported hypervisors can place email security into their established compute and network operating model, subject to correct resources and licensing.
Hybrid-cloud mail environments
Organisations using Microsoft 365, Google Workspace, Exchange or mixed mail platforms may use FortiMail as part of a layered design, with integration method chosen according to the required protection and available entitlements.
Managed security and multi-domain operations
Service providers or large organisations with multiple domains can evaluate higher VM tiers and advanced administration features, while confirming tenant, domain and operational limits before ordering.
Infrastructure-modernisation projects
A move away from dedicated appliances may create an opportunity to redesign mail security as a virtual workload. The migration plan should still account for DNS, certificates, quarantine, policies, routing, logs and coexistence.
Integration and operational considerations
Email security sits on a business-critical communication path, so the infrastructure around FortiMail should be designed with the same care as the security policy. Confirm how public DNS, MX records, smart hosts, connectors, internal DNS, network address translation, firewalls and mail-server receive connectors will interact with the VM. If the platform is in a public cloud, review routing, public and private addressing, security groups, bandwidth, egress and the availability zones or regions used by the architecture.
Certificates and sender-authentication controls also need attention. SPF, DKIM and DMARC are part of modern email trust, but the exact implementation depends on which systems send mail and where signing or validation occurs. A FortiMail project should document every legitimate sender, including SaaS platforms, ERP systems, CRM tools, scanners and applications, before tightening policies.
Finally, plan operations after go-live. Decide who reviews quarantine, who investigates false positives, who manages policy exceptions, how logs are retained, how alerts reach the security team, and how firmware and license renewals are governed. These responsibilities can be more important to long-term results than choosing between two adjacent VM sizes.
Questions to resolve before requesting a quote
Procurement checklist for FortiMail Virtual Series
How FourTeck can assist with FortiMail VM planning
A useful quotation starts with the architecture, not with a random VM SKU. FourTeck can review the intended mail platform, protected domains, expected traffic, preferred hosting environment, security-services requirement and operational model before narrowing the family. This helps reduce the risk of purchasing a VM tier that fits the vCPU count but not the domain scale, or selecting an attractive license bundle that does not include the required integration.
For implementation projects, FourTeck can also discuss installation and configuration scope, migration from an existing gateway, DNS and mail-flow changes, policy design, testing, administrator handover and support coordination. These services should be defined in the quotation because project effort varies according to the existing environment, number of domains, integrations and change-control process.
You can review related cybersecurity products on the FourTeck product catalogue, explore deployment and security services, or send the project details through the FourTeck UAE contact page.
UAE availability and support guidance
Contact FourTeck to confirm current UAE availability for the required FortiMail VM tier, license bundle and subscription term. Virtual products are still dependent on the correct regional entitlement, registration, vendor ordering process and customer requirement. Availability may vary by model, license, quantity, subscription term or vendor lead time, so the quotation should identify the exact VM and associated services instead of using a generic “FortiMail VM” line.
For projects in Dubai, Abu Dhabi, Sharjah and Ajman, FourTeck can coordinate requirement review, quotation, license planning and implementation scope after the intended deployment is understood. Installation and configuration work should be listed separately where required. Delivery or activation timing should only be planned once the commercial order, licensing details and project dependencies are confirmed.
GCC Availability
Organisations planning FortiMail Virtual Series deployments across the GCC can use FourTeck to coordinate the technical and commercial requirement before a model is selected. Projects in the United Arab Emirates, Saudi Arabia, Kuwait, Qatar, Bahrain and Oman may differ in hosting platform, subscription term, license region, security policy, data-centre architecture and local implementation needs. FourTeck can assist with requirement review, VM sizing, bundle selection, quotation coordination, configuration scope, installation planning and renewal guidance where applicable. Product availability, licensing, service visits, vendor lead times and project schedules can vary by country, VM tier, quantity and requirement. Share the destination country, intended FortiMail VM size or expected email workload, number of protected domains, deployment platform, license term and target schedule so the proposal can be aligned to the project rather than relying on a generic regional assumption. For Kuwait enquiries, buyers may also review FourTeck Kuwait resources.
Africa Availability
For African projects, FortiMail VM planning should start with the destination, infrastructure and licensing requirement rather than assuming that one virtual appliance configuration applies everywhere. FourTeck can help organisations in East Africa and other regions evaluate VM tiers, required licenses, security subscriptions, deployment resources, integration needs, renewal planning and configuration scope. Availability and fulfilment may depend on the destination country, selected model, license region, quantity, cloud or hypervisor design, power and regulatory considerations around the wider infrastructure, shipping requirements for any related hardware, vendor lead time and local project conditions. Buyers should provide the exact destination, protected-domain count, preferred deployment schedule and support expectations so the right commercial path can be reviewed. For regional information, see FourTeck Africa, FourTeck Kenya or FourTeck Uganda.
Related options to consider
FortiMail hardware appliances
Consider when a dedicated physical email-security appliance is preferred over a virtual workload.
FortiMail Cloud
Relevant when the organisation wants Fortinet-hosted email security rather than managing the underlying VM infrastructure.
FortiSandbox integration
May be evaluated where advanced analysis of suspicious files is part of the desired threat-protection architecture.
FortiAnalyzer / FortiSIEM
Useful to evaluate when centralised logging, analytics or broader security-operations visibility is required.
Migration and configuration services
Suitable for projects that need controlled transition from another secure email gateway or assistance with policy, routing and testing.
What buyers usually need to understand before choosing a FortiMail VM
A common search for FortiMail Virtual Series begins with a simple question such as “which FortiMail VM do I need?” The useful answer is not based on company size alone. VM01, VM02, VM04, VM08, VM16 and VM32 represent progressively larger resource entitlements, but the correct tier should be tied to protected domains, message traffic, inspection requirements, storage, resilience and the infrastructure available to host the virtual appliance. A small organisation with unusually heavy automated mail may need a different design from a larger office whose messaging volume is modest. Collecting real mail statistics before asking for a quote usually produces a more defensible recommendation.
It delivers the FortiMail platform in a virtual form factor, but procurement and operations are different. The customer supplies the virtual infrastructure and must respect licensed CPU and memory limits, while storage, networking and hypervisor design become part of the solution.
FortiMail can be used with cloud email environments and Fortinet documents cloud-email API integration for Microsoft and Google. The exact features and add-on entitlement should be confirmed because API-assisted controls are not the same as standard SMTP gateway filtering.
FortiMail Cloud is generally licensed per mailbox, while current FortiMail VM guidance uses VM tiers and feature bundles, with CPU/domain-oriented sizing. Do not use a hosted-cloud mailbox price to estimate a self-managed virtual appliance.
Current ordering material includes S-series VM subscription options as an OPEX route, while perpetual VM licensing remains a CAPEX path. Protection services, support and add-ons still need to be mapped to the chosen commercial model.
Another recurring buyer question is whether a virtual appliance is more flexible than hardware. It can be, especially when the organisation already manages virtual infrastructure, wants a private-cloud deployment or needs to place security functions closer to cloud-hosted workloads. However, flexibility introduces responsibility. Someone must maintain the hypervisor or cloud environment, allocate resources, protect the management plane, monitor storage, maintain backups or snapshots according to vendor guidance, and coordinate software upgrades. If the team wants to avoid those infrastructure tasks, comparing the self-managed VM with FortiMail Cloud is sensible.
Pricing questions also need careful framing. A single visible online price can represent only one VM tier, one term or one bundle and may exclude renewal, support, API integration, professional services, tax or regional conditions. The most useful quotation therefore separates the VM entitlement, FortiGuard bundle, optional services, subscription term and implementation scope. It should also identify whether a second instance is needed for resilience. This makes the first-year cost and the expected renewal path easier for procurement teams to compare.
Compatibility is another area where buyers can lose time. The FortiMail family supports several established virtualisation and cloud platforms, but the correct deployment package and current software release should match the chosen environment. If the project uses a specific VMware, Hyper-V, KVM, Nutanix or public-cloud standard, provide that platform and version to FourTeck before ordering. Also mention any requirement for high availability, separate management interfaces, DMZ placement, internal scanning, API integration or SOC tooling. These details influence the implementation design even when they do not change the base VM model.
Decision questions that improve a FortiMail Virtual Series project
What information should I send for accurate VM sizing?
Provide protected domains, current mailbox count for context, average and peak mail rates, typical message size, expected growth, outbound relay volume, existing mail platform, hosting platform and the security functions you plan to enable. If historical gateway statistics are available, they are more useful than a rough employee count.
Should I choose the next VM size up for growth?
Growth headroom is sensible, but buying a larger tier without understanding the constraint can waste budget. Identify whether the expected growth is in domains, mail volume, retention, security inspection or tenancy, then choose the tier that provides appropriate resources and commercial flexibility.
Does adding more vCPU automatically increase performance?
Not beyond the licensed entitlement. FortiMail VM licenses define maximum virtual CPU and memory resources, and exceeding those limits can invalidate the license. Performance is also affected by the host, storage, inspection features and message characteristics, so resource changes should be planned against both license and workload.
When is API integration worth considering?
It is relevant when the organisation wants supported cloud-mailbox scanning or post-delivery actions in Microsoft or Google environments beyond what an SMTP gateway alone provides. Confirm the precise add-on, supported platform and operational objective before it is added to the bill of materials.
What changes are normally required during migration?
Projects commonly involve DNS or MX planning, mail connectors, relay rules, trusted hosts, certificates, allow and block lists, quarantine workflows, anti-spam policies and monitoring. The exact steps depend on the current gateway and chosen FortiMail operating mode, so a migration runbook is preferable to an improvised cutover.
What should procurement compare besides the purchase price?
Compare the VM tier, subscription or perpetual model, FortiGuard bundle, support level, add-ons, high-availability quantity, implementation scope, renewal term and the infrastructure cost of hosting the VM. This creates a more realistic ownership comparison against hardware or a hosted email-security service.
Why businesses contact FourTeck for FortiMail projects
The main value of pre-sales assistance is reducing uncertainty before the purchase order. FourTeck can help clarify whether the requirement is better suited to FortiMail VM, a hardware appliance or a hosted model; map domain and workload information to the relevant virtual tiers; and identify licenses or add-ons that should appear in the quotation. This is particularly useful when the business request is broad—such as “secure Microsoft 365 email”—but the architecture and operational ownership have not yet been defined.
FourTeck can also coordinate compatibility review, bill-of-material guidance, configuration scope, migration planning, implementation requirements, renewal questions and regional availability checks. These are practical services rather than a claim that every FortiMail option is automatically suitable or immediately available. Learn more about FourTeck or discuss the project through the business technology contact team.
Frequently asked questions
What models are in the FortiMail Virtual Series?
Fortinet currently lists VM01, VM02, VM04, VM08, VM16 and VM32. They differ in licensed virtual CPU scale, memory and storage limits, protected-domain capacity and intended deployment size. Confirm the current ordering guide before purchasing because product and licensing details can change.
Which hypervisors and clouds can run FortiMail VM?
Fortinet publishes support for established virtualisation platforms including VMware, Hyper-V, Citrix XenServer and KVM, plus major cloud platforms. The exact supported release, deployment package and licensing method should be checked against the current FortiMail installation documentation for your target platform.
Is a FortiMail VM license required?
Yes. Fortinet states that the VM must be activated with a valid license to unlock the full licensed resource and feature range. The purchasing path can include perpetual licensing or subscription options, with FortiGuard services and add-ons selected according to requirement.
Can FortiMail Virtual Series work with Microsoft 365?
Yes, FortiMail can be used with Microsoft cloud email. Gateway deployment and supported API-level integration address different needs, so confirm whether the project needs SMTP filtering, mailbox scanning, post-delivery actions or a combination and include the correct entitlement.
How do I choose between VM01 and a larger model?
Compare protected domains, peak mail volume, inspection requirements, storage, resilience and growth against each VM tier’s resource limits. FourTeck can review these inputs and help prepare a shortlist instead of selecting only by employee count.
Are advanced threat services included by default?
Not every advanced capability should be assumed to be included. Current FortiMail ordering distinguishes base and Enterprise ATP bundles and also lists add-ons. The quotation should identify the selected security bundle and any additional integration or administration licenses.
Can I increase CPU and memory later?
Resource changes must remain within the license entitlement. Fortinet warns that assigning CPU or memory beyond the license limit can invalidate the VM license. Capacity expansion should therefore be reviewed as a sizing and licensing change, not only as a hypervisor operation.
Does FourTeck provide installation and configuration assistance?
FourTeck can discuss deployment, configuration and migration scope for UAE projects. The work required depends on the architecture, number of domains, mail platform, DNS changes, policy migration, integrations and testing requirement, so services should be defined in the quotation.
How can I check FortiMail Virtual Series availability in Dubai?
Send FourTeck the required VM tier or your sizing details, preferred licensing model, term, quantity and deployment platform. FourTeck can confirm the current UAE commercial option and coordinate a quotation. Availability and lead time depend on the exact requirement.
Plan the FortiMail VM before you price it
Share your mail platform, protected-domain count, expected message load, preferred hypervisor or cloud environment, security-service requirement and project location. FourTeck can use those inputs to review VM sizing, license structure, implementation scope and current UAE availability before preparing the quotation.