Forum Discussion

ExMSW4319's avatar
ExMSW4319
Iron Contributor
Feb 15, 2022

Matching the Received header

I'm looking to match a Received header and am running into the usual problems achieving a match. In the case of the Received header, there are six examples in a typical single message and I am wondering which one would be examined. I am using the "includes any of these words" predicate, rather than "matches these text patterns" which would have difficulties with a trailing wildcard.

 

The wording of the predicate and the GitHub definition of the Words property seem to make it fairly clear that I do not have to match the entire header exactly. Merely having one phrase match part of the header should be sufficient as long as no other characters directly abut the phrase I am testing for.

 

Should this be possible, or does EOP in fact just check the first Received header?

exchange online

2 Replies

Sort By
    • ExMSW4319's avatar
      ExMSW4319
      Iron Contributor
      Feb 15, 2022

      Victor_Ivanidze 

       

      Well, I was hoping to discover if the more responsible implementers of a certain mail API did not leave the word "unknown" in their headers:

       

      Received: from {12-digit numeral} named unknown by {guess who} with HTTPREST; {day, date, time, zone}

       

      I'm looking to match "named unknown by {guess who} with" as I don't see the need to burden the rule with expressions to match the numeral and the time stamp at the end. 

       

      {guess who} is of course a simple domain name with two period characters. It's simple constant text so there is no need for a regex pattern to match that.

Resources