On 12/20/18 7:54 PM, Amir Caspi wrote:
Are these in the From: header or the envelope-from (Return-Path)?
These are all the From: header.
Some of the ones with equal-signs look like bounce addresses from envelopes, that would not be in the From header. Or did you just look for any email address, so these could include Reply-To and emails in the body?
Nope. I explicitly looked for the From: header.They may look like VERP. They may be VERP. But remember that there's nothing that prohibits using VERP like addresses in the From: header.
This is particularly important when an email address tries to encode another email address. The original "@" usually becomes another character, frequently "=".
In general it looks like you do have a bunch that would hit on even the multi-letter rule... but if they're envelopes or destinations (not From:) then they wouldn't be searched in this rule.
They are indeed addresses in the From: header. I'm using formail to explicitly extract only the From: header. formail -c -X From:
Cheers and thanks.
You're welcome. -- Grant. . . . unix || die
smime.p7s
Description: S/MIME Cryptographic Signature
