If you are using a POP3 Connector for Microsoft Exchange, you may see inbound mail scanned as internal.
Sophos product and version
PureMessage for Microsoft Exchange 3.0.0
Windows 2003 SBS SP2
Exchange 2003 SP2
What to do
Open the PureMessage Administration Console
- Go to Configuration|System|Routing.
- Click on the 'Upstream (trusted) relays...' button.
- Click 'Add'.
- Enter the IP address of your Exchange server
- Press OK, click 'Save Changes'.
Inbound mail should now be treated correctly
When using a POP3 Connector in Exchange it effectively acts as a relay for the mail.
The POP3 mail is pulled from the ISP and then 'converted' to smtp, it is then relayed onto the Exchange mailboxes via PureMessage. This action counts as the first 'hop' for the mail. PureMessage checks the first 'hop' to see if it is an internal IP address, if it is then the internal policies are applied to it. If the IP address is an external one, then the inbound policies are applied.
By adding the IP address of the server to the list of trust relays, the first hop is ignored.