> There is nothing stopping spammers from adding fake legitimate recieved
> headers..
Sure. But as far as I know, received headers are always in reverse order
from the top of the header. So the fake headers are always at the bottom.
If you can validate the path from the top down to a legit ebay/paypal site,
then it should be valid. If you hit a break in the middle of the chain (or
find a dsl/comcast site) then anything under it is bogus.
Offhand I can't think how to do this in SA, but it can be done with some
work.
Loren
