This seems to be the magical solution to all of the XMail received headers parsing for SpamAssassin:
===== BEGIN ===== if (/\[XMail [^\]]+ ESMTP Server\]/) { if (/^from (\S+) (?:\((${IP_ADDRESS})[^\)]*\) )?by (\S+) (?:\([^\)]*\) )?with \[XMail [^\]]+ ESMTP Server\] id <([^>]+)> for(?: <[^>]*> | )from (<[^>]*>)?;/) { $helo = $1; $ip = $2; $by = $3; $id = $4; $envfrom = $5; goto enough; } } ===== END ===== I placed them before the test for Exim. Gets the helo Gets the client IP *if* it exists, and gets it whether or not the port is there Gets the server name Gets the message ID Gets the "Envelope From" *if* it exists I used a Windows RegEx tester against every XMail header variation (0,1,2,3,4) of every version (including Linux/Win32 in the names) I could find (and found what I think is every one since at least far back as 0.74 -- gotta love GOOGLE!). Everyone who feels like trying it out... please let me know how it goes for you. ------------------------------------------------------------ Jason J Ellingson Technical Consultant 615.301.1682 : nashville 612.605.1132 : minneapolis www.ellingson.com [EMAIL PROTECTED] - To unsubscribe from this list: send the line "unsubscribe xmail" in the body of a message to [EMAIL PROTECTED] For general help: send the line "help" in the body of a message to [EMAIL PROTECTED]