As a best practice, place Symantec Messaging Gateway Scanners in front of other filtering products and MTAs for the following reasons:
Filtering products and MTAs can alter or remove pre-existing message headers or modify message bodies. Symantec Messaging Gateway needs unaltered message headers and message bodies to properly filter email.
If your Scanner is not at the messaging gateway, Symantec Messaging Gateway Scanners might identify the IP address of your gateway MTA as a source of spam.
Many reputation features, such as Connection Classification, Fastpass, and sender groups that match IP addresses, do not function properly when the Scanner is downstream of one or more internal MTAs. To ensure that all incoming IP addresses are correctly identified and not confused with internal IP addresses, it is best to place your Scanner at the messaging gateway.
If you plan to place your Scanners downstream of an MTA, specify the gateway MTA IP address when you set up the appliance. You can also specify the IP address of the gateway MTA after installation through the Control Center.