https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8410
--- Comment #7 from Bill Cole <[email protected]> --- (In reply to ma.yay from comment #5) > i am not sure if i understood this. > > X-Spam-Relays-External: > X-Spam-Relays-Untrusted: > X-Spam-Last-External-IP: > > is emtpy Correct. That is because the final(top) Received header is unparseable garbage. > spamassassin should recognize o47.ptr7711.openai.com (134.128.98.111). Why? What gives SpamAssassin any reason to BELIEVE that header? It is malformed. > these are malformed and misformatted headers to avoid sa to catch the ip. The one added by "mx-gate164-hz1" IS GARBAGE. SpamAssassin cannot know what machine actually added it, so itb treats it as meaningless. SA is not able to guess that the header is in fact truthful. > 134.128.98.111 is not listed in SPF Records for @(tm.)openai.com But it IS in the SPF for em7877.tm.openai.com, which was the envelope sender domain, as shown by this header: ''' ARC-Authentication-Results: i=1; mx-gate164-hz1.hornetsecurity.com 1; spf=pass reason=mailfrom (ip=134.128.98.111, headerfrom=tm.openai.com) smtp.mailfrom=em7877.tm.openai.com smtp.helo=o47.ptr7711.openai.com; dkim=pass header.d=tm.openai.com header.s=s1 header.a=rsa-sha256; dmarc=pass hse.action=pass header.from=tm.openai.com orig.disposition=pass ''' If mx-gate164-hz1.hornetsecurity.com had simply followed the standard for Received headers (including its FQDN) and if you had 94.100.132.8 in your trusted_network setting, SA would have trusted and parsed the final Received header and trusted this header as an assertion of authentication success. > is there another way to extract the ip addresses from the Received: lines? > i have not found any builin way to do this. Not without a *legitimate* Received header instead of a useless one. > mx-gate164-hz1 is hornetsecurity.com. > i use their services for spamfiltering, but they also did not catch this one. They should fix their broken MTA. Note that this message would be very hard to catch as spam without content analysis. It really came from an OpenAI-named machine on a Sendgrid address, so it's either really from some OpenAI thing or it represents a hijack of the ability of OpenAI to send via Sendgrid. If you wish to discuss this further, feel free to post about it to the SpamAssassin-Users mailing list. There may be some trick that another user has found to work around the problem of a final delivery point adding junk headers. -- You are receiving this mail because: You are the assignee for the bug.
