I've created a header rule with "Received =~ /blahblahblah/", and I just got a false positive on it when none of the Received headers in the mail actually match. I had a similar situation last week, and (I think) found in the SA code where it will treat ezmlm headers as if they were Received headers (which explained why it hit).
Is there anywhere, other than the code, where I can see what all headers might be checked as part of a "Recevied =~" rule? -- Public key #7BBC68D9 at | Shane Williams http://pgp.mit.edu/ | System Admin - UT CompSci =----------------------------------+------------------------------- All syllogisms contain three lines | sha...@shanew.net Therefore this is not a syllogism | www.ischool.utexas.edu/~shanew