This is one thing I've been meaning to ask for some time.
The most common format, used by Sendmail and Postfix is like this:
Received: from helo.example.com (reverse.example.com [123.45.67.8])
by mail.mydomain.com (The Mailer 1.1) with ESMTP id dead1234beef
for <victim@???>; Thu, 3 Aug 2006 14:31:46 +0200 (CEST)
but Exim's default looks like this:
Received: from reverse.example.com ([123.45.67.8] helo=helo.example.com)
by mail.mydomain.com with esmtp (Exim 4.66)
id 1G8cMD-0005vx-Gx
for <victim@???>; Thu, 3 Aug 2006 14:31:46 +0200
RFC 2821 section 4.4 specifies that a Received: line consists of a number of
keyword-value pairs followed by a semicolon and a timestamp. The keywords
are "from", "by", and the optional "via", "with", "id" and "for". In mail
headers anything in parentheses is generally a comment, but here the
specification includes literal parentheses:
| From-domain = "FROM" FWS Extended-Domain CFWS
|
| By-domain = "BY" FWS Extended-Domain CFWS
|
| Extended-Domain = Domain /
| ( Domain FWS "(" TCP-info ")" ) /
| ( Address-literal FWS "(" TCP-info ")" )
|
| TCP-info = Address-literal / ( Domain FWS Address-literal )
I don't think I've ever seen any TCP-info after the "by" domain though. It's
very rare at least.
If there were a single format used by all mailer software (not that it would
happen even if there were a standard), life would be easier for tools like
SpamAssassin. Some questions I find unanswered and things therefore
particularly commonly done differently are:
* What should the format be for a locally-submitted message? I think Sendmail
omits the From-domain (actually, it puts "(from <user>)" there instead, i.e.
as a comment). Pretending that the username is a domain isn't right. Should
we say localhost instead, even though no network or domain is involved at
all? Now when I think about it, what does RFC 2821 have to do with local
submission?
* Where can or should $authenticated_sender, $sender_ident, $authenticated_id
and similar trace information be placed?
My received_header_text looks like this:
"Received: ${if def:sender_host_address {from ${if def:sender_helo_name
{$sender_helo_name} {${if def:sender_host_name {$sender_host_name}
{[$sender_host_address]}}}} (${if def:sender_host_name {$sender_host_name }}
[${if isip6{$sender_host_address}{IPv6:}}$sender_host_address])\n\t} {${if
def:sender_ident {(from $sender_ident@localhost)\n\t}}}} by
${primary_hostname} (Exim ${version_number}) ${if def:received_protocol {with
${uc:$received_protocol}}} id $message_id${if def:received_for {\n\tfor
<$received_for>}}"
This usually looks nice, but I would like a line break after the semicolon if
$received_for is empty. How come the semicolon and timestamp isn't part of
received_header_text? Appending "; $tod_full" or ";\n $tod_full" would be
easy.
--
Magnus Holmgren holmgren@???
(No Cc of list mail needed, thanks)
