On 2025-12-04 16:24, [email protected] wrote:
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8359

             Bug ID: 8359
            Summary: check_rbl @ips does not contain ip if received has
                     ipaddress:port
            Product: Spamassassin
            Version: 4.0.2
           Hardware: PC
                 OS: Linux
             Status: NEW
           Severity: normal
           Priority: P2
          Component: Plugins
           Assignee: [email protected]
           Reporter: [email protected]
   Target Milestone: Undefined

check_rbl() and check_rbl_rcvd() does not catch ip addresses from socket based
received headers.

header example:

Received: from spica25.mgt.mul.t-online.de ([172.20.102.137]) by
fwd81.aul.t-online.de
         with esmtp id 1vOz2C-4WbrJw0; Fri, 28 Nov 2025 15:01:17 +0100
Received: from 91.90.123.117:58047 by cmpweb10.aul.t-online.de with HTTP/1.1
(Lisa V8-4-3-2.0 on API V5-57-2-0); Fri, 28 Nov 25 15:01:16 +0100
Received: from 172.20.102.133:29040 by spica25.mgt.mul.t-online.de:8080; Fri,
28 Nov 2025 15:01:16 +0100 (CET)

this mail hits ALL_TRUSTED.

91.90.123.117 is not checked against any rbl but should.


is there any solution for this kind of non standard received: header?


Can you show the actual parsed TRUSTED array?

X-Spam-Relays-* from your debug logs..

Most of this comes from Received.pm, and yes it can use some additional love, but what is your expectation here?

Given that is apparently an API connection, you would be checking different RBL's based on whether it is authenticated or not.

In this case of course, the IP is probably an open proxy, but it does look like the trace headers are out of order... This might be better escalated to t-online.de to improve how they are recording those entries.



--
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Reg. TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada

Reply via email to