Views:
Trend Micro Email Security will first scan incoming email messages before final delivery to the example.com Inbound Server.
The flow of messaging traffic from the Internet, through the Trend Micro Email Security, and then to the example.com Inbound Server, or local MTA.
inbound-message-flow.jpg
Evaluation is done in the following order:
  1. The originating MTA performs a Domain Name Service (DNS) lookup of the MX record for example.com to determine the location of the example.com domain.
    The MX record for example.com points to the IP address of the Trend Micro Email Security instead of the original example.com Inbound Server.
  2. The originating MTA routes messages to Trend Micro Email Security.
  3. The Trend Micro Email Security accepts the connection from the originating mail server.
  4. Trend Micro Email Security performs connection-based filtering at the MTA connection level to decide on an action to take. Actions include the following:
    • Trend Micro Email Security terminates the connection, rejecting the messages.
    • Trend Micro Email Security accepts the messages and filters them using content-based policy filtering.
  5. Trend Micro Email Security examines the message contents to determine whether the message contains malware or any other threats.
  6. Assuming that a message is slated for delivery according to the policies, the Trend Micro Email Security routes the message to the original example.com Inbound Server.