Scanning the Received: Header

[Greg Krzeszkowski]

Hi,

Most email that comes in will have more than Received: header.   I know for a fact every single piece of incoming email into my organisation will have a header added by the firewall.

Does anyone know if all the Received: headers are scanned by MS/SA, or is it just the most recent one?   I don't seem to be seeing all log entries showing known spam senders being blocked due to a rbl lookup based on the senders domain/ip address.   All my spam matches show the SA conf variables.

Have I totally missed the point?

--------------------------
Greg Krzeszkowski
gregk at infosecsolutions.com.au