[BUGS] mail with odd headers .. me thinks

[Andrew Reilly]

On Tue, 8 Jan 2008 10:42:42 +1100
Martin Barry <marty at supine.com> wrote:

> $quoted_author = "jonathan michaels" ;
> > 
> > i recieved an odd spam this morning .. i have looked at it an
> > cannot find how it is addressesed so as to come here  to me

You can't necessarily see that, from the headers in a stored
message file.  To get to you there would have been *some* correct
form of address in the SMTP envelope, but (it seems from the rest
of the message), your MTA does not include that information in
the Received: line that it adds.

> jmdd at caamora.com.au doesn't get delivered to you? do you have a catchall?
> 
>  
> > it ended up in amongst my mailinglist debris so it would have
> > had to have had jon at caamora dot etc somewhere in teh headers
> > envelope part, as such i cannot seem to find same

Just remember: SMTP envelope doesn't (necessarily) get into
headers.  That's how BCC works, for those MUAs that have it.

> are you sure? what are you using to sort your mail?
> 
>  
> >  Received: from user.home ([78.162.75.178])
> > 	by seaholm.caamora.com.au (8.11.1/8.11.1) with SMTP id m07Mdj128953;
> > 	Tue, 8 Jan 2008 09:39:51 +1100 (EST)
> 
> >  To: <jmdd at caamora.com.au>
> 
> those two lines are the only thing to go on at the moment. were there any
> other headers?

If Jonathan's SMTP installation doesn't record the envelope MAIL
TO: address, then it's gone forever.  Some mailers will say
something like "Received: from fake.address ([sender's IP]) by
my.smtp.server (version) with SMTP id msgID for envelope-to"

My qmail-smtp server doesn't seem to, but I've seen Postfix
servers do it.

> maybe search your mail logs for the message ID?

That could have it, if it came directly.  The original envelope
address can very easily get wiped off or changed by intermediary
MTAs. (and things like fetchmail)

Cheers,

-- 
Andrew