Mark Martinec:
AuthServID by itself is not good enough, such header field must also belong to a set of trusted fields. SpamAssassin solves the problem of determining which header fields can be trusted by settings trusted_networks / internal_networks / msa_networks.
Patrick Ben Koetter:
How would you do that in a MILTER setup?
Right, you can't, as a milter adds its header before MTA gets a chance to add its Received header field. Andreas Schulze:
don't agree... A-R header are defined by RFC7001 there is also a section about "Remove Existing Header Fields": http://tools.ietf.org/html/rfc7001#section-5 replace "conforming MTA" by "conforming MILTER" while reading :-)
If a milter happens to be down there is noone to remove these header fields. There is no distinction between a milter-inserted AR field, and a case when a milter happens to be down and such header field arrives from untrusted source. Anyway, parsing AR field is nontrivial (think of all places where CFWS can appear (with nested comments), and a quoted-string (in a syntax of a 'value'), and spanning results across multiple AR header fields. Not likely to happen in the 2.11 release. Mark