I'm unclear if this is RFC compliant or not, the specs DO say in Section 3.8.2 "environments may not conform eactly to this specification" - see other RFC references..
The following line causes UNPARSEABLE_RELAY: Received: from host1.internal (host1.internal) by host2.internal (63.218.155.52) with ESMTP id m27NKoCv031779 for <[EMAIL PROTECTED]>; Fri, 7 Mar 2008 17:20:50 -0600 Simply changing the host IP to host1.internal in ( ) as below causes it to parse: Received: from host1.internal (63.218.155.52) by host2.internal (63.218.155.52) with ESMTP id m27NKoCv031779 for <[EMAIL PROTECTED]>; Fri, 7 Mar 2008 17:20:50 -0600 We have a site that we whitelist via whitelist_from_rcvd so when we get UNPARSEABLE_RELAY it ignores the whitelist. This SEEMS like a bug in spamassassin. RFC specs I read include: Section 4.1.3 Address Literals is the format, basically just IP address. Section 3.8.2:""Received:" fields of messages originating from other environments may not conform exactly to this specification..." Section 4.4 Page 51: Extended-Domain = Domain / ( Domain FWS "(" TCP-info ")" ) / ( Address-literal FWS "(" TCP-info ")" ) TCP-info = Address-literal / ( Domain FWS Address-literal ) ; Information derived by server from TCP connection ; not client EHLO. Steve Radich - http://www.aspdeveloper.net / http://www.virtualserverfaq.com BitShop, Inc. - Development, Training, Hosting, Troubleshooting - http://www.bitshop.com