Some users had issues with report events for MAIL FROM and RCPT TO when "|" appear in the mail address (yes, it seems to happen), because that's also the field separator. To make parsing the report lines a bit more straightforward, it's better to put the address as the last field.
Note that this is a protocol change, so external filters will have to be updated. Eric. Index: lka_filter.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/lka_filter.c,v retrieving revision 1.60 diff -u -p -r1.60 lka_filter.c --- lka_filter.c 8 Jan 2020 01:41:11 -0000 1.60 +++ lka_filter.c 4 Apr 2020 08:39:19 -0000 @@ -35,7 +35,7 @@ #include "smtpd.h" #include "log.h" -#define PROTOCOL_VERSION "0.5" +#define PROTOCOL_VERSION "0.6" struct filter; struct filter_session; @@ -1526,7 +1526,7 @@ lka_report_smtp_tx_mail(const char *dire break; } report_smtp_broadcast(reqid, direction, tv, "tx-mail", "%08x|%s|%s\n", - msgid, address, result); + msgid, result, address); } void @@ -1546,7 +1546,7 @@ lka_report_smtp_tx_rcpt(const char *dire break; } report_smtp_broadcast(reqid, direction, tv, "tx-rcpt", "%08x|%s|%s\n", - msgid, address, result); + msgid, result, address); } void