Quick Question - Checking Setup not used to Sophos Terminology

Question

So ISP does a basic Pre filter on email then it comes into out email server. 
 
 So new scenario is ISP Still pre filtering they have two email server and we forward all email to these two servers currently outgoing..... This is before the sophos appliance. 
 
 Now i'm just setting up the sophos appliance. 
 Please see my config below. It's the Trusted Relay i've got a question about. 
 So:- 
 Mail Delivery Servers - our existing internal email server with SMTP easy to understand added this fine. 
 Mail Domains - sorted love this being able to dump different domains to different servers we don't use this yet but it's nice might in the future 
 Internal Mail Hosts - That's clear i've just put in our internal SMTP server as that has other devices doing similar all going to it.. So instead of configuring on sophos point everything to those and they can shove it all through to Sophos. 
 (So when live we change our SMTP from forwarding to the two ip addresses of our ISP to forwarding to our Sophos appliance) 
 Outbound nail Proxy - left this blank. 
 Trusted Relays!! - THIS IS MY QUESTION Do I put the ip addresses of our ISP's email servers in here. Is this where we forward outbound to from our Sophos server (so that it emulates what we currently are doing in your standard SMTP Server).

Red_Warrior · Answer

Hi Stephanie, 
 Trusted relays are designed to allow you to bypass spam checking from an upstream relay. Normally you should not need any trusted relays, except perhaps in the case you mentioned where you have an upstream mail provider accepting mail and relaying it downstream. 
 
 for example: 
 an email header may have 2-10 "received by" headers, during the spam checking process we care about whats referred to as the "first un-trusted relay" or fur if you set your upstream relay as trusted when the appliance is looking at received by headers it will "start" checking from the FUR .. witch will be the last relay before anything that is set as trusted.. 
 
 received by 4 
 received by 3 
 received by 2 
 received by 1 
 
 normally spam checking would start with relay 1 and work its way back.. if relay 1 is your isp doing upstream checking of mail and you set it as a trusted relay .. then spam checking will start with relay 2. 
 
 important note: 
 setting relays as trusted should be used only if necessary, setting a spammer ip or a range that is used as an open relay will result in all of that mail been delivered. I recommend only setting it as trusted if you are having issues that can not be resolved by sending in samples to the labs team. 
 
 other cases where trusted relays would be used. 
 for an upstream loadbalancer that is tagging emails with its ip. (ideally you don't want your load balancer touching headers) 
 if you had more than one appliance in line.. or say a firewall that's accepting mail with an mta vs port forwarding 25 (anything that port forwards should not be a trusted relay) 
 
 ideally you would only want one point of spam checking to avoid having 2 quarantines, and or false positives/negatives between the two or more appliances.