Header Analysis

This help section describes the email header delivery path analysis: this is how ORF determines the sender IP address of an email which will be used for the IP-based tests at the On Arrival filtering point.

To understand the entire process, it is recommended to read the Filtering Points Concept and Intermediate Host List topics as well.

Delivery path

When an email is relayed through multiple hosts, each adds its own information to the email MIME header as Received: from lines, so the delivery path of the email can be examined in the email header by ORF:

Note that the header is available at the On Arrival filtering point only. At Before Arrival, ORF will simply use the connecting IP address for the IP-based tests, or (if the connecting IP is an Intermediate Host) it will wait for the header to arrive and test the email at On Arrival.

Analysis Explained

The analysis starts with the first IP address in the delivery path (the latest delivery hop). ORF checks whether the IP is listed on the Intermediate Host List and steps to the next hop if it is.

Stepping down in the list continues until the first non-intermediate host is found, and the IP of that host will be used during IP-based tests at the On Arrival filtering point.

Delivery hops

The delivery hops from the above header are:

• 5.5.5.5, index = 1
• 3.3.3.3, index = 2
• 1.1.1.1, index = 3

The email seems to be sent from 1.1.1.1 (looks like DSL line) via a relay at 3.3.3.3 (looks like the DSL user's ISP mail relay) to the secondary MX of domain.tld (5.5.5.5). The secondary MX relayed the email to the primary MX (primarymx.domain.tld) where ORF runs.

Analysis & results

Let us assume that 5.5.5.5 (the secondary MX for domain.tld) is on the Intermediate Host List—it should be there.

The analysis will go as:

• Remote Peer IP: 5.5.5.5 is on the Intermediate Host List, skip to the next delivery hop.
• Sender IP: 3.3.3.3 is neither on the Intermediate Host List, nor a local or intranet address: we can end the analysis here.
• Source IP: 1.1.1.1 is the host that originally sent the email.

The result of the analysis is that the server resposible for the delivery of the email to your network was 3.3.3.3, so ORF will use this IP for its IP-based tests.