> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Set Up Email Routing in xorlab

> Set up email routing on xorlab for on-premises integration, with a guide for each target architecture.

<Warning>
  **Prerequisites**

  * Complete [Before You Begin](/latest/before-begin-integration)
</Warning>

Follow one guide of the following that fits your target architecture:

<CardGroup cols={2}>
  <Card title="Inline (Add-on)" icon="shield" href="#configure-as-inline-add-on">
    Default. xorlab is located between your gateway and exchange server.
  </Card>

  <Card title="Inline (Gateway)" icon="key" href="#configure-as-inline-gateway">
    xorlab is the gateway and receives/sends emails from/to the internet.
  </Card>

  <Card title="Monitoring" icon="envelope-open-text" href="#configure-for-monitoring">
    xorlab receives only a copy of every email, and discards it after processing.
  </Card>
</CardGroup>

## Configure as Inline add-on

As Inline add-on, xorlab will:

* Deliver incoming emails to `<inbound-next-hop>` (usually an Exchange server)
* Deliver outgoing emails to `<outbound-next-hop>` (the Gateway)

Follow these steps:

1. Go to `activeguard/mta/startup_cfg/postfix_custom/` in the Expert Editor.

2. Open `main.cf` and enable `transport_maps`:

   ```ini main.cf theme={null}
   transport_maps = lmdb:/etc/postfix/transport
   ```

3. Open `transport`. Create it if it does not exist. Add a line for every guarded domain with `<inbound-next-hop>` and one line for all outgoing emails with `<outbound-next-hop`:

   ```ini transport theme={null}
   # Inbound emails
   xorlab.com  smtp:<inbound-next-hop>
   xorlab.net  smtp:<inbound-next-hop>
   # Outbound emails
   *           smtp:<outbound-next-hop>
   ```

   <Accordion title="Subdomains">
     By default, subdomains need to be added separately. Please see [Subdomain matching](/latest/smtp-configuration#subdomain-matching) to change the default.
   </Accordion>

   <Accordion title="Fallback">
     You can specify fallbacks if the first destination is not reachable: `smtp:[1.2.3.4],[2.2.2.2]`.
   </Accordion>

4. Open `client_access` and add the IP of every email server that will send emails to xorlab:

   ```ini client_access theme={null}
   # Permit this IP to send emails to xorlab
   <ip-address1>   permit
   <ip-address2>   permit

   # You can also permit domains. The domain name is determined by means of a reverse DNS lookup and automatically extends to subdomains. 
   example.com   permit
   ```

5. Click **Publish**. The inline add-on configuration becomes active within about one minute.

## Configure as Inline gateway

As Inline gateway, xorlab will:

* Deliver incoming emails to `<inbound-next-hop>` (usually an Exchange server)
* Deliver outgoing emails directly to the external recipient

Follow these steps:

1. Go to `activeguard/mta/startup_cfg/postfix_custom/` in the Expert Editor.

2. Open `main.cf` and enable `transport_maps`:

   ```ini main.cf theme={null}
   transport_maps = lmdb:/etc/postfix/transport
   ```

3. In `main.cf`, add all guarded domains as `relay_domains`:

   ```ini main.cf theme={null}
   # Only add domains to the relay_domains, this will automatically include subdomains as well
   # xorlab will accept emails to these domains from every IP
   relay_domains = xorlab.com, xorlab.net
   ```

4. Open `transport`. Create it if it does not exist. Add a line for every guarded domain with `<inbound-next-hop>`:

   ```ini transport theme={null}
   # Inbound emails
   xorlab.com  smtp:<inbound-next-hop>
   xorlab.net  smtp:<inbound-next-hop>
   ```

   <Accordion title="Subdomains">
     By default, subdomains need to be added separately. Please see [Subdomain matching](/latest/smtp-configuration#subdomain-matching) to change the default.
   </Accordion>

   <Accordion title="Fallback">
     You can specify fallbacks if the first destination is not reachable: `smtp:[1.2.3.4],[2.2.2.2]`.
   </Accordion>

5. Open `client_access` and add the IP of every email server that will send emails to xorlab:

   ```ini client_access theme={null}
   # Permit this IP to send emails to xorlab
   <ip-address1>   permit
   <ip-address2>   permit

   # You can also permit domains. The domain name is determined by means of a reverse DNS lookup and automatically extends to subdomains. 
   example.com   permit
   ```

6. Click **Publish**. The inline gateway configuration becomes active within about one minute.

## Configure for Monitoring

In Monitoring Mode, xorlab discards all received emails. Here we configure the routing for emails that are generated by xorlab itself (for example feedback notifications).

1. Go to `activeguard/mta/startup_cfg/postfix_custom/` in the Expert Editor.

2. Specify the relay destination in the `main.cf` file:

   ```ini main.cf theme={null}
   ## Route all emails to this host
   relayhost = relay.host.com
   ```

3. Open `client_access` and add the IP of every email server that will send emails to xorlab:

   ```ini client_access theme={null}
   # Permit this IP to send emails to xorlab
   <ip-address1>   permit
   <ip-address2>   permit

   # You can also permit domains. The domain name is determined by means of a reverse DNS lookup and automatically extends to subdomains. 
   example.com   permit
   ```

4. Click **Publish**. The monitoring configuration becomes active within about one minute.

## Next steps

Forward emails to xorlab in the mode you chose:

* *Monitoring*: [Cisco ESA](/latest/on-prem-esa-monitoring-mode) or [Exchange](/latest/on-prem-exchange-monitoring-mode)
* *Inline*: [Exchange](/latest/on-prem-exchange-inline)