If you're downloading all your O365 mail and pulling the IP out of
that header, then it's always going to be in the same format and
dealing with it is trivial. Beyond that, when would it be safe to
trust this received header, anyway? Unless it's the most recent one,
could it not be faked?
In the past I've had to deal with DNSBL listings based on faked
received headers-- IMHO, it's not safe to parse IPs beyond connections
that you yourself have verified.
Regards,
Al Iverson
On Wed, Apr 18, 2018 at 7:20 PM, Michael Wise via mailop
<mailop@mailop.org> wrote:
>
>
> So the only bit we're missing is wrapping the IP literal in []'s.
>
> I'll see if I can get that looked at, but somehow I doubt they're gonna do
> anything because after years of doing it this way ...
>
>
>
> There are many dependencies internally. ☹
>
>
>
> Aloha,
>
> Michael.
>
> --
>
> Michael J Wise
> Microsoft Corporation| Spam Analysis
>
> "Your Spam Specimen Has Been Processed."
>
> Got the Junk Mail Reporting Tool ?
>
>
>
> -----Original Message-----
> From: mailop <mailop-boun...@mailop.org> On Behalf Of Jeremy Harris
> Sent: Wednesday, April 18, 2018 3:41 PM
> To: mailop@mailop.org
> Subject: Re: [mailop] Received header address information
>
>
>
> On 18/04/18 23:03, Michael Wise via mailop wrote:
>
>> Sorry, what section of 2821?
>
>
>
> 5821 has
>
>
>
>
>
> 4.4. Trace Information
>
> "MUST insert trace ("time stamp" or "Received")"
>
>
>
> "The FROM clause, which MUST be supplied in an SMTP environment,
>
> SHOULD contain both (1) the name of the source host as presented
>
> in the EHLO command and (2) an address literal containing the IP
>
> address of the source, determined from the TCP connection."
>
>
>
>
>
> 4.1.3. Address Literals
>
> "For IPv4 addresses, this form uses four small decimal integers
>
> separated by dots and enclosed by brackets such as [123.255.37.2]"
>
>
>
> --
>
> Cheers,
>
> Jeremy
>
>
>
> _______________________________________________
>
> mailop mailing list
>
> mailop@mailop.org
>
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fchilli.nosignal.org%2Fcgi-bin%2Fmailman%2Flistinfo%2Fmailop&data=02%7C01%7Cmichael.wise%40microsoft.com%7Ca083312477324c882c4308d5a57e23db%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636596883551840214&sdata=jImPbccsOXBY7kt9n0WrJ25chKz40SWqcwgRRs0y7ik%3D&reserved=0
>
>
> _______________________________________________
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
--
al iverson // wombatmail // miami
http://www.aliverson.com
http://www.spamresource.com
_______________________________________________
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
