That's correct, senderbase reputation filtering occurs very early on. At the IP/TCP level of a connection. To get more info on this, check out the user guide on HAT Overview.
Since senderbase reputation filtering occurs early on, even before the mail-from/rcpt-to/subject information are obtained, it is too late to enforce LDAP settings.
However, what you can do with ldap is verify if the sender or recipient are a member of a certain group and then disable anti-spam/anti-virus/content filtering from their email. You would use ldap-from-group in conjunction with incoming or outgoing mail policies.
To make an email immune from senderbase reputation filtering, you would need to know the IP/hostname/partial hostname of where their message is coming from and add that info to the whitelist sendergroup in the HAT overview.
Is it possible to completely disable the reputation filter based on whether the recipient is in a certain LDAP group?
I'm currently thinking no as LDAP groups are assigned a message filter and by this point in the pipeline the reputation filter has already been applied.
Perhaps someone more experienced can confirm/disprove this for me?
