The Intermediate Host List should consist of IP addresses of your SMTP front-ends and/or secondary MX's (if there are any), so ORF can take these into account when it determines the actual source IP of an email, which will be used for its IP-based tests (e.g., tested against online DNS Blacklist or used for the SPF test).
Setting up the Intermediate Host List correctly is crucial for accurate filtering. The list is available under in the navigation.
Before Arrival, ORF will consider the remote peer IP address of the SMTP connection as the sender and use the connecting IP for its IP-based tests. If ORF runs on the perimeter server (receiving emails directly), this is the actual sender IP.
However, if incoming emails are first relayed through several other hosts (perimeter servers, gateways, secondary MX's, etc.) before ORF could test them, the connecting IP address seen at the Before Arrival filtering point will be the last relaying host instead of the actual sender IP.
In this case, such relaying hosts should be added to the Intermediate Host List: ORF will skip Before Arrival tests, and waits for the whole email to arrive. At the On Arrival filtering point, it examines the email header which contains information about the hosts the email was relayed through. It checks the last host first: if it is listed on the Intermediate Host List, it is skipped and ORF checks the next. Checking these so-called delivery hops continues until ORF finds a non-Intermediate Host, which is the original sender IP (and can be used for the IP-based tests at the On Arrival filtering point).
More about ORF's header and delivery path analysis is available in the Header Analysis section.
Click the New button to add an IP address or IP address range to the list. To modify an existing address definition, click Modify or hit Enter. IP address definitions can be deleted using the Delete button or the Delete key.
The local host address (127.0.0.1), the Class A (10.0.0.0 - 10.255.255.255), Class B (172.16.0.0 - 172.31.255.255) and C (192.168.0.0 - 192.168.255.255) private intranet address ranges, and the IPv6 link-local (fe80::/10) and IPv6 unique local (fc00::/7) address ranges are treated as Intermediate hosts by default: emails sent directly from such addresses are excluded from filtering to avoid accidental blacklisting of internal and outgoing emails.
Incoming emails will never originate from such addresses, only relayed through them to the server with ORF installed. In such scenarios, ORF will check the delivery path of the email in the header and considers the first external (non-intermediate) host as the sender. For more information, see the Header Analysis section.
Due to the above reasons, these intranet addresses are hardcoded and cannot be removed from the configuration.
Click the column header of any column by which you wish to sort the list. To reverse sorting, click the column header again.
Right-click on the address list and select "Import List..." or "Export List...". Alternatively, you can do this from the menu, select or
Right-click on the list item or items and select "Search in logs..." to find log records that match the defined expression. Logs need to be loaded in the Log Viewer beforehand.
See the IP Address Editor Dialog topic.