You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@spamassassin.apache.org on 2026/09/02 22:24:23 UTC
[Bug 8410] New: Received: Header not all from senders are parsed
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8410
Bug ID: 8410
Summary: Received: Header not all from senders are parsed
Product: Spamassassin
Version: 4.0.2
Hardware: PC
OS: Windows 10
Status: NEW
Severity: normal
Priority: P2
Component: Rules
Assignee: dev@spamassassin.apache.org
Reporter: ma.yay@mytechnet.de
Target Milestone: Undefined
Example:
Received: from o47.ptr7711.openai.com (134.128.98.111) by mx-gate164-hz1; Wed,
02 Sep
2026 01:43:19 +0200
Received: by recvd-7456777fb5-5qbtj with SMTP id
recvd-7456777fb5-5qbtj-1-6A976304-26 2026-09-01 23:43:00.436086277 +0000 UTC
m=+3041449.106515704
Received: from MjAyMTY3MDY (unknown) by geopod-ismtpd-26 (SG) with HTTP
id
-oeOy6VeQPG0JvqztP4wGQ Tue, 01 Sep 2026 23:43:00.429 +0000 (UTC)
spammassin -t does not show recognize 134.128.98.111 as Untrusted
any ideas how to fix this?
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 8410] Received: Header not all from senders are parsed
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8410
--- Comment #3 from ma.yay@mytechnet.de ---
spamassassin should add o47.ptr7711.openai.com (134.128.98.111) to
Untrusted-Relays but it does not.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 8410] Received: Header not all from senders are parsed
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8410
ma.yay@mytechnet.de changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |ma.yay@mytechnet.de
--- Comment #2 from ma.yay@mytechnet.de ---
Created attachment 6075
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=6075&action=edit
testcase openai via SendGrid obfuscated
this is an example.
this is abused SendGrid with obfuscated Received: lines to hide the 3rd Hop.
spamassassin does not recognize this and rules UNPARSEABLE_RELAY
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 8410] Received: Header not all from senders are parsed
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8410
--- Comment #7 from Bill Cole <bi...@apache.org> ---
(In reply to ma.yay from comment #5)
> i am not sure if i understood this.
>
> X-Spam-Relays-External:
> X-Spam-Relays-Untrusted:
> X-Spam-Last-External-IP:
>
> is emtpy
Correct. That is because the final(top) Received header is unparseable garbage.
> spamassassin should recognize o47.ptr7711.openai.com (134.128.98.111).
Why? What gives SpamAssassin any reason to BELIEVE that header? It is
malformed.
> these are malformed and misformatted headers to avoid sa to catch the ip.
The one added by "mx-gate164-hz1" IS GARBAGE. SpamAssassin cannot know what
machine actually added it, so itb treats it as meaningless.
SA is not able to guess that the header is in fact truthful.
> 134.128.98.111 is not listed in SPF Records for @(tm.)openai.com
But it IS in the SPF for em7877.tm.openai.com, which was the envelope sender
domain, as shown by this header:
'''
ARC-Authentication-Results: i=1; mx-gate164-hz1.hornetsecurity.com 1; spf=pass
reason=mailfrom
(ip=134.128.98.111, headerfrom=tm.openai.com)
smtp.mailfrom=em7877.tm.openai.com smtp.helo=o47.ptr7711.openai.com;
dkim=pass header.d=tm.openai.com header.s=s1 header.a=rsa-sha256; dmarc=pass
hse.action=pass header.from=tm.openai.com orig.disposition=pass
'''
If mx-gate164-hz1.hornetsecurity.com had simply followed the standard for
Received headers (including its FQDN) and if you had 94.100.132.8 in your
trusted_network setting, SA would have trusted and parsed the final Received
header and trusted this header as an assertion of authentication success.
> is there another way to extract the ip addresses from the Received: lines?
> i have not found any builin way to do this.
Not without a *legitimate* Received header instead of a useless one.
> mx-gate164-hz1 is hornetsecurity.com.
> i use their services for spamfiltering, but they also did not catch this one.
They should fix their broken MTA.
Note that this message would be very hard to catch as spam without content
analysis. It really came from an OpenAI-named machine on a Sendgrid address, so
it's either really from some OpenAI thing or it represents a hijack of the
ability of OpenAI to send via Sendgrid.
If you wish to discuss this further, feel free to post about it to the
SpamAssassin-Users mailing list. There may be some trick that another user has
found to work around the problem of a final delivery point adding junk headers.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 8410] Received: Header not all from senders are parsed
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8410
--- Comment #6 from ma.yay@mytechnet.de ---
just to clatify the obfuscation with the <tab>
Received contains <tab>:
Received: from o47.ptr7711.openai.com (134.128.98.111) by mx-gate164-hz1; Wed,
02 Sep
2026 01:43:19 +0200
Received: by recvd-7456777fb5-5qbtj with SMTP id
recvd-7456777fb5-5qbtj-1-6A976304-26<tab>2026-09-01 23:43:00.436086277 +0000
UTC
m=+3041449.106515704
Received: from MjAyMTY3MDY (unknown)<tab>by geopod-ismtpd-26 (SG) with
HTTP<tab>id
-oeOy6VeQPG0JvqztP4wGQ<tab>Tue, 01 Sep 2026 23:43:00.429 +0000 (UTC)
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 8410] Received: Header not all from senders are parsed
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8410
Bill Cole <bi...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |billcole@apache.org
--- Comment #1 from Bill Cole <bi...@apache.org> ---
A more complete set of headers and the value of your *_networks settings may
reveal a way to solve the problem.
On the other hand, this *looks* like recent mail delivery via Apple iCloud, and
I've noticed problems with other tools (e.g. SpamCop) being unable to figure
out what is going on with iCloud mail. I will investigate whether SA is capable
of deciphering Apple misguided Received headers.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 8410] Received: Header not all from senders are parsed
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8410
Bill Cole <bi...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |INVALID
Status|NEW |RESOLVED
--- Comment #4 from Bill Cole <bi...@apache.org> ---
(In reply to ma.yay from comment #3)
> spamassassin should add o47.ptr7711.openai.com (134.128.98.111) to
> Untrusted-Relays but it does not.
The lack of any qualified hostnames of *receiving* systems makes all of the
Received headers unparseable. As far as SA is concerned, all of the Received
headers are garbage and it trusts NONE of them.
SA can only set Untrusted-Relays if it has some trust anchor in the form of a
Received header from a host in trusted_networks. Because mx-gate164-hz1 in the
final Received header is unqualified, SA cannot tell whether it is trusted, and
so SA has no reason to believe that the header written by mx-gate164-hz1 is
meaningful.
If you can persuade whoever controls mx-gate164-hz1 to write proper Received
headers with FQDNs, this would be fixed. As it is, SA cannot construct any
audit trail with those Received headers.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 8410] Received: Header not all from senders are parsed
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8410
--- Comment #5 from ma.yay@mytechnet.de ---
i am not sure if i understood this.
X-Spam-Relays-External:
X-Spam-Relays-Untrusted:
X-Spam-Last-External-IP:
is emtpy
spamassassin should recognize o47.ptr7711.openai.com (134.128.98.111).
these are malformed and misformatted headers to avoid sa to catch the ip.
134.128.98.111 is not listed in SPF Records for @(tm.)openai.com
is there another way to extract the ip addresses from the Received: lines?
i have not found any builin way to do this.
mx-gate164-hz1 is hornetsecurity.com.
i use their services for spamfiltering, but they also did not catch this one.
Received: from o47.ptr7711.openai.com (134.128.98.111) by mx-gate164-hz1; Wed,
02 Sep
2026 01:43:19 +0200
Received: by recvd-7456777fb5-5qbtj with SMTP id
recvd-7456777fb5-5qbtj-1-6A976304-26 2026-09-01 23:43:00.436086277 +0000 UTC
m=+3041449.106515704
Received: from MjAyMTY3MDY (unknown) by geopod-ismtpd-26 (SG) with HTTP
id
-oeOy6VeQPG0JvqztP4wGQ Tue, 01 Sep 2026 23:43:00.429 +0000 (UTC)
--
You are receiving this mail because:
You are the assignee for the bug.