Re: Rule to detect non-standard headers that aren't X- prefixed

2022-05-11 Thread John Hardin
On Tue, 10 May 2022, Philip Prindeville wrote: Anyone have a rule to detect the following nonsense headers seen in this message I got? Return-Path: Received: from cp24.deluxehosting.com (cp24.deluxehosting.com [207.55.244.13]) by mail (envelope-sender ) (MIMEDefang) with ESMTP id

Re: DMARC fails for valid record?

2022-05-11 Thread Alex
Hi, On Tue, May 10, 2022 at 7:00 PM Kevin A. McGrail wrote: > I believe this is a bug and fixed in trunk. > > On 5/10/2022 1:55 PM, Bill Cole wrote: > > Looks like a bug. It should not be possible to hit DKIM_VALID_AU and > also DMARC_REJECT and/or KAM_DMARC_REJECT > This was from svn version

Re: DMARC fails for valid record?

2022-05-11 Thread Matus UHLAR - fantomas
On 2022-05-10 20:39, Matus UHLAR - fantomas wrote: From: nore...@ess.firstdata.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=6g5c7kdjkv3qjrxjsdzn3325ejghli53; d=ess.firstdata.com; t=1652117979;

Re: Rule to detect non-standard headers that aren't X- prefixed

2022-05-11 Thread Henrik K
On Wed, May 11, 2022 at 10:49:32AM +0300, Henrik K wrote: > On Wed, May 11, 2022 at 10:44:05AM +0300, Henrik K wrote: > > On Tue, May 10, 2022 at 06:19:38PM -0600, Philip Prindeville wrote: > > > See my original message. > > > > > > I can't think of a single way to match each header, and then

Re: Rule to detect non-standard headers that aren't X- prefixed

2022-05-11 Thread Henrik K
On Wed, May 11, 2022 at 10:44:05AM +0300, Henrik K wrote: > On Tue, May 10, 2022 at 06:19:38PM -0600, Philip Prindeville wrote: > > See my original message. > > > > I can't think of a single way to match each header, and then test for any > > of them not matching the pattern... > > Simply use

Re: Rule to detect non-standard headers that aren't X- prefixed

2022-05-11 Thread Henrik K
On Tue, May 10, 2022 at 06:19:38PM -0600, Philip Prindeville wrote: > See my original message. > > I can't think of a single way to match each header, and then test for any of > them not matching the pattern... Simply use regex negative lookahead. ALL =~ /^(?!Foo|Bar):/m It will hit any line

Re: Rule to detect non-standard headers that aren't X- prefixed

2022-05-11 Thread Martin Gregorie
On Tue, 2022-05-10 at 18:19 -0600, Philip Prindeville wrote: > I can't think of a single way to match each header, and then test for > any of them not matching the pattern... > > I had in mind a subrule that triggers on valid header names, combined with a meta rule that inverts the subrule