Test Order and Priority

This section describes the test order and priority in ORF.

Filtering Points

Tests at the Before Arrival filtering point are executed earlier than the On Arrival filtering point tests, so the Before Arrival filtering point has higher priority than the On Arrival (see the "Filtering Points" Concept section for more information).

Tests at the Before Arrival Filtering Point

• Whitelist check: Authenticated session check (AUTH Whitelist)
• Whitelist check: IP whitelist
• Blacklist check: Honeypot test (only if excepted)
• Blacklist check: DHA protection test (only if excepted)
• Blacklist check: Recipient blacklist (only if excepted)
• Blacklist check: Recipient validation (only if excepted)
• Blacklist check: SPF test (only if excepted)
• Whitelist check: Sender whitelist
• Whitelist check: Recipient whitelist
• Whitelist check: Automatic Sender Whitelist
• Whitelist check: DNS whitelist
• Blacklist check: HELO blacklist
• Blacklist check: IP blacklist
• Blacklist check: Sender blacklist
• Blacklist check: Honeypot test
• Blacklist check: DHA protection test
• Blacklist check: Recipient blacklist
• Blacklist check: Recipient validation
• Blacklist check: SPF test
• Blacklist check: Reverse DNS test
• Blacklist check: DNS blacklists
• Blacklist check: Greylisting

Tests at the On Arrival Filtering Point

• Whitelist check: Authenticated session check (AUTH Whitelist)
• Whitelist check: IP whitelist
• Blacklist check: Honeypot test (only if excepted)
• Blacklist check: DHA protection test (only if excepted)
• Blacklist check: Recipient blacklist (only if excepted)
• Blacklist check: Recipient validation (only if excepted)
• Blacklist check: Attachment filter (only if excepted)
• Blacklist check: DMARC Test (only if excepted)
• Blacklist check: SPF test (only if excepted)
• Blacklist check: DKIM test (only if excepted)
• Blacklist check: External Agents (only if excepted)
• Whitelist check: Sender whitelist
• Whitelist check: Recipient whitelist
• Whitelist check: Automatic Sender Whitelist
• Whitelist check: Keyword whitelist
• Whitelist check: DKIM whitelist
• Whitelist check: DNS whitelist
• Blacklist check: HELO blacklist
• Blacklist check: IP blacklist
• Blacklist check: Sender blacklist
• Blacklist check: Honeypot test
• Blacklist check: DHA protection test
• Blacklist check: Recipient blacklist
• Blacklist check: Recipient validation
• Blacklist check: Charset blacklist
• Blacklist check: Attachment filtering
• Blacklist check: Keyword blacklist
• Blacklist check: URL domain blacklist
• Blacklist check: Reverse DNS test
• Blacklist check: DNS blacklists
• Blacklist check: DMARC test
• Blacklist check: SPF test
• Blacklist check: DKIM test
• Blacklist check: External Agents

Whitelist and Blacklist Priority

Whitelists take precedence over any of the blacklists, i.e., once the email or recipient was whitelisted, the email or recipient will not be blacklisted by ORF. Exceptions to this rule can be configured in the ORF Administration Tool.

Optimizations

Some of these blacklist test above may not be performed in every case due to optimizations in the filtering engine (e.g., no keyword filtering is performed if the keyword filter expression list is empty).