I think it was Michael Parker (thanks) that gave me the tip that SA might not be reading my headers right. I followed up on that and confirmed. I'm getting the above debug message when I run a test on a specific single spam that made it through. Here is my whole debug line showing the header in the mail:
debug: received-header: unknown format: from harmonypets.every1.net ([222.47.73.116])by myhost.mydomain.com (8.13.1/8.13.1) with SMTP id i9UBhAFh025756;Sat, 30 Oct 2004 07:43:12 -0400 I looked at the parse_received_headers code, and I can see some tests that I thought this would match. One potential difference is no "for" message.. received from * by * with * "for". My headers don't have that for line often while many of the regexs seem to expect that. Is this a common format I should have? Is my sendmail tweaked? Any known changes in the header format added by sendmail 8.13.1 that could be slipping through all the regexs? Thanks jp