On 2021-02-23 16:29, John Hardin wrote: > On Tue, 23 Feb 2021, Dan Malm wrote: > >> On 2021-02-19 16:13, John Hardin wrote: >>> uOn Fri, 19 Feb 2021, Dan Malm wrote: >>> >>>> I have a system that received mail from a webmail product that adds a >>>> X-Originating-IP header with the IP of the webmail user. >>>> >>>> Since Spamassassin for some reason considers that to be a >>>> Received-header that results in all mails from the webmail hitting the >>>> RDNS_NONE rule (only IP is added in the header) which I currently have >>>> set to 0 due to this. >>> >>> Could you post a sample of the headers from such? Obfuscate as you like, >>> I'm just wondering about the order in which they appear. >> >> Received: from onecom-webmail1 (service.pub.appspod1-cph3.one.com >> [46.30.211.130]) >> by mailrelay3 (Halon) with ESMTPSA >> id 89da92dc-72a5-11eb-bf40-fd1a731c465d; >> Fri, 19 Feb 2021 11:28:08 +0000 (UTC) >> X-Originating-IP: 46.30.211.29 >> User-Agent: One.com webmail 39.4.34 >> Date: Fri, 19 Feb 2021 12:28:08 +0100 >> MIME-Version: 1.0 >> Message-ID: <1613734088881.26136.389428@webmail1> >> To: <o...@slave.one> >> From: "One" <o...@nyck.se> >> Reply-To: <o...@nyck.se> >> Subject: testing >> Content-Type: multipart/alternative; >> boundary="----------389426-1613734088881-1" > > ...and I assume that neither of those addresses are configured as > "internal" for you? > >
They are currently not, no. And "X-Originating-IP: 46.30.211.29" is the IP the webserver handling the webmail saw for this mail, i.e. the user IP, which for normal users will often be in PBL. It's also the IP that triggers the hit on RDNS_NONE -- BR/Mvh. Dan Malm, Systems Engineer, One.com
