IP Reputation Order of Evaluation

Message sender IP addresses go through IP reputation-based filtering. IP addresses are evaluated until the first match is found.

Messages from allowed sender IP addresses bypass IP reputation-based filtering at the MTA connection level and proceed to spam detection. Messages from blocked sender IP addresses are blocked.

The order of evaluation for IP addresses in the lists on the Approved and Blocked IP Addresses screen is based on which list contains the IP address or Classless Inter-Domain Routing (CIDR) block.

Evaluation is done in the following order:

  1. IP addresses

    1. On the Approved IP Addresses screen

    2. On the Blocked IP Addresses screen

  2. The Country/Region list

    1. On the Approved IP Addresses screen

    2. On the Blocked IP Addresses screen

  3. The known spam source (RBL) in the IP Reputation settings

  4. The dynamically assigned IP (DUL) in the IP Reputation settings

  5. The emerging threat list (ETL) in the IP Reputation settings

An IP address added to the IP addresses on the Approved IP Addresses screen will not be blocked even if that IP address is also in a CIDR block listed on the Blocked IP Addresses screen. Furthermore, that IP address will not be blocked even if it is also in the Known Spam Source standard IP reputation database list.

Important:

IP reputation-based filters use only IP address data to filter messages. You can also use sender email address and domain to filter incoming messages. Approved senders bypass IP reputation-based filtering at the MTA connection level.

See Managing Sender Filter.