This section describes the On Arrival filtering point.
Filtering at the On Arrival filtering point is performed when the entire email had arrived from the sender server, but before the data would be acknowledged by the Exchange Transport / IIS SMTP Service (see the "Filtering Points" Concept topic for more information).
The On Arrival filtering is performed once per email, regardless the number of recipients.
ORF analyzes the email header at this filtering point and extracts the delivery path information. It determines the actual sender IP by examining the hosts which through the email was relayed, and the first non-intermediate host will be used for the IP-based tests such as the DNS blacklist test, the IP whitelist and blacklist and the DNS whitelist.
Read the Header Analysis section for more information.
If you have Exchange 2007 x64 (or a later Exchange version), you can redirect blacklisted emails to the Junk E-Mail folder of each recipient for further review. For more information, read our article.
When the email has only a single recipient and that is blacklisted (either by the Recipient Blacklist or by the Recipient Validation Test of ORF), the email gets rejected, because there are no valid recipients. If the email has multiple recipients and only some of the recipients are blacklisted, the blacklisted recipients are removed from the recipient list, but the remaining valid recipients still get the email.
If the incoming email has only whitelisted recipients, the entire email gets whitelisted and all recipients get the email. If the email has multiple recipients and only some of the recipients are whitelisted, ORF marks the whitelisted recipients and continues checking the email. If the email gets blacklisted, ORF forks a copy of the email for the whitelisted recipients, so they get the original message.