Taking mail header order in consideration when filtering

Question

My incoming mail server is checking SPF and adds a line in the headers accordingly. However sometimes previous servers are adding similar headers so there is multiple Received-SPF headers.

Received-SPF: Softfail...
Sender: ...
Received-SPF: pass ...

I have a procmail filter to sort incoming mail according to its SPF status but it does not currently account for where in the headers it appears.

Can I make rules taking into account where in the headers a line appears? Or are there other tools suitable for this?

Is there a way to distinguish between headers added by the incoming server, above the first(last added) Received header, and headers added by another server.

Any reason you couldn't just strip every other `Received-SPF` header before you add yours? — Shane Madden, Feb 09 '12 at 17:11
The only one I can think of would be for trace-ability. The extra information could be useful when reporting spam back to the originating server. So I could just as well remove all other non verified headers such as Received. Still since that never done afaik I'm curious of what tools there exist that do take the order of headers into consideration. — hultqvist, Feb 09 '12 at 21:40

score 1 · Accepted Answer · answered Feb 10 '12 at 07:30

Procmail can do multi-line matching. In contrast to many other regex variants, in Procmail, an embedded $ stands for the newline between two lines. How exactly to identify the correct Received-SPF: header obviously depends on your network topology, but something like

:0
* ^Received-spf: pass.*$Received: from .* by yourgateway
... whatever

... assuming that your inbound MX (here, yourgateway) adds a Received header first, then adds a Received-SPF before that. It could be the other way around, too; without example headers, we can't know. There's also the possibility of additional headers between these two, but it's probably something we can ignore.

Taking mail header order in consideration when filtering

1 Answers1