Choose a key from information already available

Do not use message content before the content has arrived.

• A tuple is an ordered group of values used together as a lookup key. Connection-level policy can use the source IP address, sometimes a corresponding host name; HELO/EHLO policy adds the client’s greeting parameter; MAIL policy can add the envelope return address (§§2.1–2.3). These are separate possible policies, not a requirement to apply every gate.
• At RCPT, recipient information is available. Section5 recommends the tuple (IP address, RFC5321.MailFrom, first RFC5321.RcptTo). MailFrom is the envelope return path, not the visible From header; RcptTo is an envelope recipient, not the visible To header. The example preserves spelling and uses the first recipient, without claiming that all implementations use this key (§§2.4,5 item1).
• DATA-level checks can occur on receipt of DATA, after the complete envelope, or after the terminating dot, when the message has been transferred. Header fields, subject, a digest of content and body analysis are possible only at the latter point (§2.5). A digest is a summary used for comparison here, not a proof of who sent mail.
• Post-DATA content processing costs more because the body has to be received and temporarily stored. Content can also change between retries, yielding a different key. Section2.6 describes additional reputation/dynamic-address heuristics; these are possible targeting inputs, not guaranteed abuse verdicts (§§2.5–2.6,3,4.1).
• Connection-stage unknown-source handling may use421 and close, or other4yz replies to subsequent commands; later described policies defer for the remainder of the session. The guide shows one gate at a time and omits routine SMTP commands and unrelated errors (§§2.1–2.5).