Thanks, I think you got it right - my mailserver is behind a NAT. So, do I put the external address of my mailserver in the trusted networks config option or the behind the NAT address?
You want the "behind the nat" address. Basically what you want in there is the IP your mailserver inserts into the headers on inbound mail.. That's the private IP because the server doesn't know it's NATed, and this is what makes SA assume "that can't possibly be the internet exchanger, it's a reserved address".
(for reference, I know all this because xanadu.evi-inc.com is NATed)
