Every email will be assigned one of the following four directions:
- Incoming: The domain of the recipient is guarded, but the domain of the sender is not.
- Outgoing: The domain of the sender is guarded, but the domain of the recipient is not.
- Internal: The domain of the sender and recipient are both guarded.
- External: Neither sender nor recipient domain is guarded.
The direction is important because by default, only Incoming emails are filtered. The direction assignment is done based on sender and recipient, and not based on IP address or a dedicated listener.
A sender that can’t be authenticated is always considered as not guarded.
External directionThe direction External is in almost all cases caused by a configuration issue: Either a domain is missing from guarded_tenants.yml, or xorlab is accidentally receiving emails for a domain that it should not receive any. For a properly configured xorlab, there should be no External emails. You can check this with the search direction:external.
External verdict vs. External directionIn addition to the External direction, there is also a verdict External. The latter has nothing to do with the direction, and is the fallback verdict for benign emails that cannot be categorized further.
