http://bugzilla.spamassassin.org/show_bug.cgi?id=3295
------- Additional Comments From [EMAIL PROTECTED] 2004-04-22 17:32 ------- I've decided that the orbitz.com example is working as designed. Since orbitz.com is not listed as trusted, there is no way to know that the Received header that mentions mx.orbitz.com is not forged. If mail from [EMAIL PROTECTED] goes first through mailfoo.wm.orbitz.com and then through mailbar.orbitz.com, the correct domain to list in the def_whitelist_rcvd has to be orbitz.com. I could see including both just in case. Regarding the two remaining FPs: I'll deal with the second one first, because it raises fewer questions. If I interpret your obfuscation of names correctly, has the recipient at example.net on a system that runs its mail server in the domain example.org. example.org should be on the list of trusted_networks in this configuration, and then I think the FP should go away. If it isn't listed as trusted, this system is going to get other false positives for dialup rules, for example. Can you confirm if this is correct? The remaining FP is from a mailing list. It comes from a yahoo-inc address with the last trusted server being that of the mailing list server. Now I don't have a simple answer. How are we dealing with cases like this in other situations where we have to accurately identify which Received headers can be trusted? ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee.
