I've been through the SA man pages, etc., and can't find a description of
rule matching that answers this question: when more than one header of a
certain type exists, will a rule requiring a negative match count once per
e-mail, or once per header.
All headers of the same name are concatenated into a single header for the
rule match, I believe.
I am not sure whether the headers will be separated by newlines in the
string, or merely by spaces.
For Received headers specifically, there are also a number of meta-headers
built by SA that do not appear in the message, but can be used in rule
matching. These break the headers out by trusted, untrusted, etc. The
format of these headers is I think a little different thant he normal
Received headers. The format should be documented somewhere; I haven't
looked for it.
Loren
