On Fri, 7 Jun 2019 16:30:58 +0100 Niamh Holding wrote: > Hello John, > > Friday, June 7, 2019, 3:56:03 PM, you wrote: > > JH> If you're getting FPs on this, I suggest you review your internal > JH> hosts. It looks for reserved IP ranges in external Received > JH> headers. > > This? > > * 3.3 FORGED_RELAY_MUA_TO_MX No description available. > . > . > . > X-Spam-Relays-Untrusted: [ ip=162.208.32.167 > rdns=sv07.members.wayfair.com helo=sv07.members.wayfair.com > by=nitrogen.huntingdon.holtain.net ident= envfrom= intl=0 id= auth= > msa=0 ] [ ip=162.208.32.167 rdns= helo= by= ident= envfrom= intl=0 > id= auth= msa=0 ] .
See my previous description of what the rule does we have [ ip=162.208.32.167 ... ] [ ip=162.208.32.167 ... helo= ] > Received: from sv07.members.wayfair.com (162.208.32.167) > by nitrogen.huntingdon.holtain.net with AES256-SHA encrypted SMTP; > 7 Jun 2019 14:05:51 +0100 . This provides the first section of X-Spam-Relays-Untrusted. > Received: by sv07.members.wayfair.com id hv9giu2gvtc7 for > <ni...@fullbore.co.uk>; Fri, 7 Jun 2019 09:05:44 -0400 (envelope-from > <boun...@members.wayfair.co.uk>) This is not the second section, the parser will have skipped it.
