Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My incoming mail server is checking SPF and adds a line in the headers accordingly. However sometimes previous servers are adding similar headers so there is multiple Received-SPF headers.

Received-SPF: Softfail...
Received: from ...
Received: by ...
Sender: ...
Received: by ...
Received: by ...
Received: by ...
Received: by ...
Received-SPF: pass ...
Received: by ...

I have a procmail filter to sort incoming mail according to its SPF status but it does not currently account for where in the headers it appears.

Can I make rules taking into account where in the headers a line appears? Or are there other tools suitable for this?

Is there a way to distinguish between headers added by the incoming server, above the first(last added) Received header, and headers added by another server.

share|improve this question
Any reason you couldn't just strip every other Received-SPF header before you add yours? – Shane Madden Feb 9 '12 at 17:11
The only one I can think of would be for trace-ability. The extra information could be useful when reporting spam back to the originating server. So I could just as well remove all other non verified headers such as Received. Still since that never done afaik I'm curious of what tools there exist that do take the order of headers into consideration. – hultqvist Feb 9 '12 at 21:40
up vote 1 down vote accepted

Procmail can do multi-line matching. In contrast to many other regex variants, in Procmail, an embedded $ stands for the newline between two lines. How exactly to identify the correct Received-SPF: header obviously depends on your network topology, but something like

* ^Received-spf: pass.*$Received: from .* by yourgateway
... whatever

... assuming that your inbound MX (here, yourgateway) adds a Received header first, then adds a Received-SPF before that. It could be the other way around, too; without example headers, we can't know. There's also the possibility of additional headers between these two, but it's probably something we can ignore.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.