On 13 Apr 2005 at 16:44, Andy Schmidt wrote:
Very well done Andy..
-Nick
>
> Okay, let me try it this way...
>
> RFC 822 states:
>
> 3.1.2. STRUCTURE OF HEADER FIELDS
>
> Once a field has been unfolded, it may be viewed as being com-
> posed of a field-name followed by a colon (":"), followed by a
> field-body, and terminated by a carriage-return/line-feed.
> The field-name must be composed of printable ASCII characters
> (i.e., characters that have values between 33. and 126.,
> decimal, except colon). The field-body may be composed of any
> ASCII characters, except CR or LF. (While CR and/or LF may be
> present in the actual text, they are removed by the action of
> unfolding the field.)
> My reading of the RFC is, that 0x20 (32) is NOT permitted as a header
> field name! Thus:
>
> X-Spam-Tests-Failed Weight:
>
> is NOT to be interpreted as a valid header!
> Best Regards
> Andy Schmidt
>
> Phone: +1 201 934-3414 x20 (Business)
> Fax: +1 201 934-9206
>
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Wednesday,
> April 13, 2005 04:28 PM To: Declude.JunkMail@declude.com Subject: Re:
> [Declude.JunkMail] Something new with v 2.0.6
>
> Good Thought but I have these others without problem. Thanks.
>
> XINHEADER X-Note: Total spam weight of this E-mail is %WEIGHT%.
> XINHEADERX-RBL-Warning: Total weight: %WEIGHT%
> XINHEADERX-Note: This E-mail was scanned & filtered by TCB
> [%VERSION%] for SPAM & virus.
> XINHEADERX-Note: Sent from: %MAILFROM%
> XINHEADERX-Note: Sent from Reverse DNS: %REVDNS% ([%REMOTEIP%])
> XINHEADERX-Note: Recipient(s): %REALRECIPS%
> ----- Original Message -----
> From: Andy Schmidt
> To: Declude.JunkMail@declude.com
> Sent: Wednesday, April 13, 2005 4:02 PM
> Subject: RE: [Declude.JunkMail] Something new with v 2.0.6
>
> Hi Frederick:
>
> I don't know if this has been asked/suggested already and I don't have
> time to go back to the RFCs to see if embedded spaces are permitted in
> the header name. But have you ever tried eliminating that space:
>
> XINHEADERX-Spam-Tests-Failed Weight: %TESTSFAILEDWITHWEIGHTS%
>
> replace with:
>
> XINHEADERX-Spam-Tests-Failed-Weight: %TESTSFAILEDWITHWEIGHTS%
>
>
>
> May be the problem is that there is a CR/LF followed by a line that
> contains no header name(due to the embedded space) following by
> another CR/LF. May be those two CR/LF without valid header information
> inbetween are interpreted as "start of message body" by some entities?
> Best Regards Andy Schmidt
>
> Phone: +1 201 934-3414 x20 (Business)
> Fax: +1 201 934-9206
>
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Wednesday,
> April 13, 2005 03:42 PM To: Declude.JunkMail@declude.com Subject: Re:
> [Declude.JunkMail] Something new with v 2.0.6
>
> Mike/Matt (thanks for your help) You should be able to duplicated by
> just forwarding an email to an outside account using the problem line
> at the bottom.
>
> As not to confuse things I simplified the process.
>
> Send an email from [EMAIL PROTECTED]>>>
> [EMAIL PROTECTED](forwarded to) =>>> [EMAIL PROTECTED]
>
> This run through only one server on my network.
>
>
> Header from My AOL account.
> Return-Path: <[EMAIL PROTECTED]>
> Received: from rly-xm04.mx.aol.com (rly-xm04.mail.aol.com
> [172.20.83.105]) by air-xm03.mail.aol.com (v105.26) with ESMTP id
> MAILINXM31-606425d743d132; Wed, 13 Apr 2005 15:34:25 -0400 Received:
> from bks.tcbinc.com (bks.tcbinc.com [64.124.117.196]) by
> rly-xm04.mx.aol.com (v105.26) with ESMTP id MAILRELAYINXM42-
> 606425d743d132; Wed, 13 Apr 2005 15:34:21 -0400 Received: from
> SMTP32-FWD by bks.tcbinc.com
> (SMTP32) id A741100040470EC67; Wed, 13 Apr 2005 15:33:42
> Received: from web51806.mail.yahoo.com [206.190.38.237] by
> bks.tcbinc.com
> (SMTPD32-8.15) id A41140470; Wed, 13 Apr 2005 15:33:37 -0400
> Received: (qmail 50369 invoked by uid 60001); 13 Apr 2005 19:34:12 -
> 0000 Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
> DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
> s=s1024; d=yahoo.com;
>
> b=M12dWrk8x99pS4FhLTVJbfbgIc60YrjkjS/Vi2yiCoare5X2fk5F+zDzAA2XuOKAyAuK
> oj3EEGBHc6gPlwybZ/TMSShXoJtIypUpKUZZrm7SoU0rx30hedmPe9IecDArBynamRJFf8
> HjmCsGFKGIwJhKUjwV4wNnw1wLdarF7SE= ; Message-ID:
> <[EMAIL PROTECTED]> Received: from
> [64.124.117.139] by web51806.mail.yahoo.com via HTTP; Wed, 13 Apr 2005
> 12:34:12 PDT Date: Wed, 13 Apr 2005 12:34:12 -0700 (PDT) From:
> Frederick Samarelli <[EMAIL PROTECTED]> Subject: test10 To:
> [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: text/plain;
> charset=us-ascii X-RBL-Warning: SNIFFERZERO: Message failed
> SNIFFERZERO: 0. X-Declude-Sender: [EMAIL PROTECTED] [206.190.38.237]
> X-Declude-Spoolname: D741100040470EC67.SMD X-Note: Total spam weight
> of this E-mail is 0. X-RBL-Warning: Total weight: 0 X-Note: This
> E-mail was scanned & filtered by TCB [2.0.6] for SPAM & virus.
> X-Spam-Tests-Failed: SNIFFERZERO Message Body (should only be the word
> test10) X-Spam-Tests-Failed Weight: SNIFFERZERO [0]
> X-Spam-Time:15:33:42 X-Weight: 0 X-Mailfrom: samarelli.yahoo.com
> X-Note: Sent from: [EMAIL PROTECTED] X-Note: Sent from Reverse DNS:
> web51806.mail.yahoo.com ([206.190.38.237]) X-Hello:
> web51806.mail.yahoo.com X-Note: Recipient(s): [EMAIL PROTECTED]
> X-Country-Chain: UNITED STATES->destination X-AOL-IP: 64.124.117.196
> X-AOL-SCOLL-SCORE:0:0:0: X-AOL-SCOLL-URL_COUNT:0 test10 Culprit:
> XINHEADERX-Spam-Tests-Failed Weight: %TESTSFAILEDWITHWEIGHTS%
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
