Noel Jones wrote: > On 9/28/2009 11:17 AM, Brian Evans - Postfix List wrote: >> Noel Jones wrote: >>> On 9/28/2009 10:35 AM, Brian Evans - Postfix List wrote: >>>> How would you detect a quoted-printable line feed in header checks? >>>> >>>> I get lots of spam that includes several of these and would like to >>>> reject them early. >>>> >>>> If there is a good reason not to do this, please note such. >> So something like: header_checks=pcre:/path/to/file >> >> /^Subject: .*=0A/ REJECT Bad Subject format >> >> would work? > > Yes, that should do the trick. > >> >> This is RFC breakage behavior I am trying to stop in the Subject line. >> http://tools.ietf.org/html/rfc5322#section-2.2 > > The section says you can't use the LF character. Nothing in that > section says you can't use "=0A" in your Subject. > > OK.. then how about this refined pcre:
/^Subject: =\?.*\?Q\?.*(=0A(\s)?)*\?=$/ REJECT Bad Subject format With the inclusion of the quoted-printable header definition, I think the chances of false positives would be very low.
