This section describes the Before Arrival filtering point.
As the name implies, the Before Arrival filtering point is a stage when ORF filters emails and this filtering happens before the email would arrive. Due to this, the only possible action upon blacklisting is rejection. The email cannot be tagged or redirected, as it has not arrived yet.
ORF talks about recipients instead of emails at the Before Arrival filtering point, e.g., the log says "X recipient was rejected, because Y is on the sender blacklist". While this sounds confusing for the first time, in fact it is the recipient rejected.
The Before Arrival filtering is performed when the sender server specifies the recipient(s) in the RCPT TO: stage of the SMTP transport (see the "Filtering Points" Concept topic for more information). Each RCPT TO: command specifies a recipient and each time Before Arrival tests run: when a blacklisting is triggered, ORF rejects the recipient, specified by the sender in the given RCPT TO: command.
We could say "the email was blacklisted at Before Arrival" only if all recipients were blacklisted, but it is simpler to log the results of each Before Arrival tests per recipient (the way they are performed), instead of logging messages like "At Before Arrival, the email was blacklisted for John, whitelisted for Brian, and passed all checks for Mary and Sue".
Note that Before Arrival tests are performed per recipient and not per email: if an email has multiple recipients, it is possible that for some the email will be rejected, for others, it won't be.
ORF uses the IP address of the incoming SMTP connection for IP-based tests, such as the DNS Blacklist Test, or the SPF Test. This is the correct behavior if ORF runs on the perimeter server receiving emails directly.
However, if the email is relayed through several other hosts (gateways, backup MX's) before ORF tests them, these hosts should be added to the Intermediate Host List: this way, ORF will know that the connecting IP is not the actual sender and it has to wait for the entire email to arrive before performing any IP-based tests.