Joseph Brennan wrote: > > > Excerpt, headers from a generated message from myspace (I have folded > lines for legibility) : > > Received: from vmta17.myspace.com (vmta17.myspace.com [204.16.33.80]) > by cayenne.cc.columbia.edu (8.14.1/8.14.1) with ESMTP id l9U3N5he001961 > for <[EMAIL PROTECTED]>; Mon, 29 Oct 2007 23:23:10 -0400 (EDT) > Received: from els2mwebnet1425 (10.44.128.43) by vmta17.myspace.com > (PowerMTA(TM) v3.2r17) id h4qhps0f2do3 for <[EMAIL PROTECTED]>; > Mon, 29 Oct 2007 20:23:05 -0700 (envelope-from > <[EMAIL PROTECTED]>) > mime-version: 1.0 > from: "=?iso-8859-1?Q?MySpace Admin?=" > <[EMAIL PROTECTED]> > to: [EMAIL PROTECTED] > reply-to: "=?iso-8859-1?Q?MySpace Admin?=" > <[EMAIL PROTECTED]> > date: 29 Oct 2007 20:23:04 -0700 > subject: MySpace account cancellation request - please confirm > content-type: text/plain; charset=utf-8 > content-transfer-encoding: base64 > > > > Notice the all-lower-case field names, which do not conform to the > RFC 2822 field names that they almost match. That is, a "from:" > header is not the same as a "From:" header! > > It looks like the FROM ends up undefined in Spamassasssin, and so > this cannot be whitelisted. I'm not necessarily saying Spamassassin > is wrong either. Any opinions?
Works for me, at least using SA 3.2.3 it does. >From spamassassin -tLD < testmessage.txt ------------------ [6091] dbg: eval: all '*From' addrs: 04.15.0.64763231393140636F6C756D6269612E656 [EMAIL PROTECTED] [EMAIL PROTECTED] ------------------
