> Source: [sk184646](https://support.checkpoint.com/results/sk/sk184646)

# sk184646 - Check Point MTA adds  a localhost "Received:" header when forwarding email

| Property | Value |
|----------|-------|
| Solution ID | sk184646 |
| Date Created | 2026-02-08 |
| Last Modified | 2026-02-10 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * After deploying Check Point MTA behind an upstream mail gateway/relay, you see an additional `"Received:"` header in messages processed by the MTA. For example:  

  `Received: from localhost (localhost [127.0.0.1])`

* Some downstream email security/anti-spam systems that rely only on the topmost `Received:` header can incorrectly treat the message as originating from an internal source (localhost), affecting message classification and reporting.

## Cause

This behavior occurs because each SMTP hop is required to add its own "Received:" header, as defined in [RFC 5322](https://datatracker.ietf.org/doc/html/rfc5322) section 4.4 (Trace Information).  
When the upstream mail gateway hands the message to Check Point MTA using an internal, local injection hop, the immediate peer is 127.0.0.1.  
The MTA correctly records this as the most recent hop.  
Earlier Internet?facing hops remain preserved in the lower "Received:" headers.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content