Create a Post
Showing results for 
Search instead for 
Did you mean: 

MTA "Received:" header

I'm running Check Point MTA version 8120.991002021 on active-standby cluster (R81.20 JHF Take 41). It runs as the organization MX record. Only configured in $FWDIR/conf/ No changes in $FWDIR/conf/mail_security_config.

MTA is working as expected. But for every email from internet to our organization MTA adds headers like this:

Received: from localhost (localhost [])
by (Postfix) with ESMTP id 4T7zDy6xdyz6PXZ
for <>; Mon, 8 Jan 2024 16:56:02 +0100 (CET)
X-MTA-CheckPoint: {659C1B12-0-F35B6A0A-33EA}
Category=, control=Content Anti Spam
X-Control-Analysis: str=0001.0A682F22.659C1B13.0003,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0
Received: from (localhost [])
by (Postfix) with ESMTPS id 4T7zDy5jnKz6PXY
for <>; Mon, 8 Jan 2024 16:56:02 +0100 (CET)
Received: by with SMTP id e9e14a558f8ab-3608bd50cbeso4579985ab.3
for <>; Mon, 08 Jan 2024 07:56:02 -0800 (PST)

The problem for me is the red text. Why MTA doesn't fill the real IP address of the google mail server and uses the localhost [] instead?

Emails with such headers are marked as spam when they are forwared to Office 365.

0 Kudos
1 Reply

If I had to guess, it's because of how traffic is directed to Postfix (the underlying MTA used).
In any case, this is probably worth a TAC case: 

0 Kudos


Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events