Sorry to follow up on myself, but... > > depending on how many hops a mail takes > > the number of such headers increases
Yes, so a refinement may be to make the threshold depend in some way on the number of Received: headers too. This would clearly have to be an eval() test. Regards, David.
