hi,

lately, i see more and more spam which have a X-Message-Info: header embedded between Received: headers, like

Received: from  ...blah blah...
X-Message-Info: 31iOCamNW4Lqooq4inEUndCY4PC6uZOOmrZ53
Received: from  ...blah blah...

from what i see on my site corpus, i'd say we don't receive legitimate mail which has such an embedded X-Message-Info.
there could (not verifiable) however be legitimate mail which have a X-Message-Info header, but then it is not embedded between Received headers


is it possible in spamassassin (via regexp ?) to test for a "sandwiched" X-Message-Info: header between Received: headers ?

or more globally, can a regexp test spawn over multiple header lines ?

Thanks



Reply via email to