Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When sending mail through PHP mail() - Postfix adds the following header:

Received: by (Postfix, from userid 48)
    id XXXXXXXXXXX; Sun, 20 Nov 2011 21:22:13 +0100 (CET)

Is there a way to remove the userid part, but keep the rest? So the result becomes (if correct):

Received: by (Postfix)
    id XXXXXXXXXXX; Sun, 20 Nov 2011 21:22:13 +0100 (CET)

Postfix is running on localhost and is only used to send mail from PHP through the mail() function.

A simular question regarding removing the whole header has been asked before, but I can't figure out how to remove the userid part, but keep the rest.

share|improve this question
up vote 2 down vote accepted

I think you can try something like:


header_checks = pcre:/etc/postfix/header_checks.pcre


/^Received: by(.*) (Postfix, from userid(.*)$/ REPLACE Received: by ${1} 

(I could be wrong with regex, but it should work)

share|improve this answer

You shall not edit the received lines in any case.

Mainly they are required by RFC 5321 and are not allowed to manipulate. Secondly they are a valuable source for tracking abuse.

Assume you only send mails with PHP via Apache (userid 48), what does it tell you if you see messages coming from userid 5000? You are right: A malicious user or script is running mad. Are you able to track this problem with userid removed?

share|improve this answer
Good points. However, I think the header exposes too much of the web server setup. I ended up with the following, wich only hides the userid when the Apache user is sending: /^Received: by (.+) \(Postfix, from userid 48\)(.+)$/ REPLACE Received: by $1 (Postfix)$2 (maybe I should change 48 to e.g. 550 instead, to not mess with the header construct) – elaxsj Nov 22 '11 at 15:20

Now you can change only first line. My solution is with regexp


header_checks = regexp:/etc/postfix/header_checks


/^Received: by (.*) .*Postfix, from userid [0-9]+\)\s*id ([A-F[:digit:]]+)(.*) (.*)/ REPLACE Received: by $1 (some text) id $2$3 (EEST)

You can check rezult (


postmap -q "Received: by (Postfix, from userid 48) id 5F7CD1E148A Thu, 23 Oct 2014 15:55:08 +0300 (EEST)" regexp:/etc/postfix/header_checks
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.