Confirming from the Groups.io side, with a bit of detail from a report
I pulled apart today.

The report itself now comes From: <[email protected]>, MAIL FROM
[email protected], Message-ID @jmrp.protection.outlook.com, with
"User-Agent: JMRP/1.0" in the feedback-report part and
"X-MS-Exchange-Generated-Message-Source: DC Pre Content Filter Agent"
on the outer message.

One thing I haven't seen mentioned in the thread: the new reports carry
"Auto-Submitted: auto-generated". Our inbound MX has dropped
auto-submitted mail to anything other than bounce addresses for years,
so every JMRP report going back as far as I looked (mid-August)
was silently discarded before our FBL parser ever saw it. If you filter
on Auto-Submitted, it's worth checking whether your JMRP feed quietly
died at the same time the format changed.

In the embedded message:

- Return-Path is gone entirely, not replaced with <X>, just absent.
- To, Sender, Reply-To, Delivered-To, Mailing-List, and the "for <...>"
  clause of every Received line are <X>.
- X-HmXmrOriginalRecipient is gone.
- The body is gone.
- The message/feedback-report part has only Feedback-Type, User-Agent
  and Version. No Original-Rcpt-To, no Original-Mail-From.

On Michael's timestamp point: the "received from IP ... on <date>"
line in the human-readable part is the report generation time. In my
sample our delivery was at 12:55:51Z and the report says 12:56:14Z.

What survives intact: Message-ID, In-Reply-To/References, Subject,
From, List-Id, DKIM-Signature, and, usefully, List-Unsubscribe
(including our per-recipient one-click URL with the subscription
identifiers untouched), plus arbitrary X- headers. So the redaction
appears to be "anything that looks like an email address", and Al's
advice holds: recipient identity encoded in a non-address header comes
through fine.

Cheers,
Mark
Groups.io
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop

Reply via email to