On 9/15/2011 4:07 PM, Michael C. Robinson wrote: > I've looked at emails I've been setting aside and have noticed that > there are 5 received from lines that my servers post. The one I > probably want is posted first when the external SMTP server contacts my > relay. After that, my server passes the message to amavis which > produces two Received from lines. At this point, the message is passed > to my postfix mailhub. Finally, the fifth Received from relates to the > hub delivering the message. So I am assuming that I want the first of > these five received from lines and I am assuming that I don't care about > the rest of the received from lines considering that they might be > faked. > > I am attaching my perl script that is responsible for extracting the > correct received from line from an mbox file. Comments on how to > improve this script are welcome.
Reading the headers from the top down, the first one with a "foreign" client received by your host is the one you want. Sounds as if you're looking at the right one. Other headers above that added by your system are trustworthy. Headers added by others below yours (including X-Originating) are not trustworthy, but may still be useful as spam indicators. Just don't necessarily believe them. If you frequently need to know the client that connected to your gateway, you can use a check_client_access map to PREPEND the client IP in a custom header. Headers you add yourself are trustworthy. Something like: # main.cf smtpd_data_restrictions = check_client_access regexp:add_ip.regexp # add_ip.regexp IF /^[0-9.]+$/ /^(.*)$/ PREPEND X-robinson-client-ip: $1 ENDIF -- Noel Jones
