The HAT is a table on the SEG (ESA) that controls how inbound email from different senders is handled. It maps senders to sender groups, and each sender group has a mail flow policy that defines what to do with their email.
Structure
Sender (IP or domain) → Sender Group → Mail Flow Policy (MFP) → Action
Common sender groups
| Group | Typical use |
|---|---|
| WHITELIST | Trusted senders, bypass most checks |
| BLOCKED_LIST | Blocked senders, reject at connection |
| SUSPECTLIST | Low reputation, throttled |
| UNKNOWNLIST | Default for unknown senders |
How senders are matched
- By IP address
- By PTR/reverse DNS (preferred — IPs can change, domains don’t)
- SBRS score can auto-assign to groups