hi,
lately, i see more and more spam which have a X-Message-Info: header embedded between Received: headers, like
Received: from ...blah blah... X-Message-Info: 31iOCamNW4Lqooq4inEUndCY4PC6uZOOmrZ53 Received: from ...blah blah...
from what i see on my site corpus, i'd say we don't receive legitimate mail which has such an embedded X-Message-Info.
there could (not verifiable) however be legitimate mail which have a X-Message-Info header, but then it is not embedded between Received headers
is it possible in spamassassin (via regexp ?) to test for a "sandwiched" X-Message-Info: header between Received: headers ?
or more globally, can a regexp test spawn over multiple header lines ?
Thanks