X-Headers not caught by filters

testing4tester · ‎06-30-2014

Good morning everyone,

I came across a strange issue with usage of X-Headers in content filters and I was unable to find answer to it elsewhere.

All e-mails coming now to my IronPort have an extra X-Header, namely X-Originating-IP. I created a content filter that should log value of this header. The rule has form: Originating_IP: $Header[\"X-Originating-IP\"] (Note: backslashes are added automatically on submission). However when tested, there is no value recorded. I tried to use same form to log other headers, like From:, and everything worked fined. I tried also with other X-Headers, but non of them was logged. I tried escaping dashes in header's name, but this was not successful either (on submission another backslash is added).

So my question is how X-Headers can be used in content filters rules?

Thank you in advance for any tips!

Tom Foucha · ‎07-08-2014

Permit me a question: All emails coming to my IronPort have an extra X-Header......are these internal emails coming to the IronPort or external emails? Is the Content Filter you are creating Inbound or Outbound? X-Headers are used frequently in Content Filters, I would recommend you also use the TRACE tool to test your configuration.