duplicate subject lines in headers (again)

Mon Nov 7 11:57:11 UTC 2016

> I do not see this. I have sent test messages that pass through two
> MailScanner instances - one on the way out of my desktop and one on the
> way in to my MX server - with Subject headers with trailing whitespace
> and the headers are never duplicated and the whitespace isn't stripped.
> In both MailScanner instances "Multiple Headers" is set to add.

> I have tried one trailing space, two trailing spaces and a trailing tab.
> In all cases the result is the same except for the specific whitespace
> in the Subject: of the delivered message, one of which is attached.

> If I'm not doing the correct test, please explain in more detail what
>the issue is so I can understand how to test.

--

Hi Mark,

Thanks for taking a look. It is difficult to replicate because there appears to be some yahoo MXs that cause the mail to fail the check, and others which let it succeed.

Here is the MIME from a mail that succeeded (heavily obfuscated):

-Apparently-To: yahoo_recipient at yahoo.com; Mon, 07 Nov 2016 11:27:54 +0000
Return-Path: <sender at domain.com>
Received-SPF: none (domain of domain.com does not designate permitted sender hosts)
X-YMailISG: YUKT5o8WLDtItuOErV1n0YBy3SqwMNtbPX5Bg1YUO9IYVPo6
 ggdMf2ksknQU_zpy4JlibiQ23ZayBzX1IxbLlt6bIqlEE0Y_nKCmv93.VZxM
 8u8kq4oHFuGQCRN8gGjbKycdKPWjnkdF89beBkvMkTp.NXSmMg7J.C3MNfF4
 6dhy3kNNy9BsVmkNLnFhuBVp8hGrQOhXN44CyIFO3krRertda6e10r.DRl6x
 CdPtZbKJ70Un3PPxRD0Ds.PjNuU3vGoySbJthIRFDzb242n45.QHQZCaaSkP
 HOs18747XlWR6MJeq_C.kmjLTEgGWSxgsm35RYIVevxGJtC6SLXz1rYQNhel
 rKINbCYrnLEnoACdrgCbRVou0zGcDfmzpqM64pc6Q6LJIUM8KRUSRGnkFxg.
 sayWN77gpXxwsIyw68rPetLmS6eZPklIrXvrtnN0ZkuSx.LsRLqJuCneKzeS
 Leu.duRtgrKgcwVEsYOCmdy3Kpb0xIcCGt6Y_i6VBRrhlbZ30yAfapvtTVoI
 w5t3ITP_A4Kl1WuvTs8AccftdLYBlYhmcQPvJH5IHwYS6vIeL62bCT0uQo.m
 Yt8N8WKvSyPvpMN1ZTbwzF60F_ghj_lr8pjNSBG4nM6dIwp9RiDJ298TZKtd
 pcKfITiuXPcRpeJIbGU_r2ienZlg2xRt2AEZGVUhVU6vNySv60Oj9wp1u765
 wxh5X10IZ3ARa9PdgNLh5eN24hS0leqVuhDgvl3X0BHCxy78nFbGPI52gZNb
 ESEuUIYK8CRIU21D4LL51jnP_fDedaUJXa22ZX_EruzJOrSSzlPf8Xas0ZAv
 _E4lO95zhp.kqe5WhzNyBS1oGxJIIGiraMBNtEcxr9sc9cpXGnhW5QfjEwi5
 Dsgf.Sy6Ilt54eUXfg4QDxvpBw8Y7pDitUgV7PEVe0DjJhPtLhUohgmHshPz
 EKC1.I4780FgVl9.lyQlNtWdZi1_Elwyy_0unhMwdeO8mOmk_QFxwJ8qcSDh
 ZkEqhg8KU5kPqWvi9WHnT5MSN9e_25Fu9o2WYHcpBtMLcQMshvZ8KFnuEfeJ
 aJpzwIHL8mcyJ2iWfKQMZ8xHccGIw0xPUvCUw9kMl6JEdF.RF5oOKqpnLIxt
 sF.mxvrUJBA7a8Chr4rz8veMTOuOf0HXJiPNQVeSjRNBH1tMR1O6KB5j_mC1
 RVB40GcjhKV9FTB0WPfjKlRSB8to8ys7_f32iW0AeVhIIpVUKCBJpi28E1x_
 daDnI_mGF4.L4pNLZfwRG14ZdK77drqNkHWlGhmeT4dxwfzf_DG_z2IkQXTw
 gNm3GtAQCu59jo2D.YdAOVtNF_J.d8l9ZQ6lLD5lkn_6iZm3.ua0NJbTVMx0
 gevdxR.PaD6nbH5FKLY7UWZGlgOcKVVIY4RcwQJPJmQC64hh5aa4fbf.H8yl
 oLYnbQ--
X-Originating-IP: [195.245.230.169]
Authentication-Results: mta1489.mail.ne1.yahoo.com  from=; domainkeys=neutral (no sig);  from=domain.com; dkim=neutral (no sig)
Received: from 127.0.0.1  (EHLO mail1.bemta3.messagelabs.com) (195.245.230.169)
  by mta1489.mail.ne1.yahoo.com with SMTP; Mon, 07 Nov 2016 11:27:53 +0000
Return-Path: <sender at domain.com>
Received: from [85.158.137.99] by server-9.bemta-3.messagelabs.com id ED/C3-08915-63560285; Mon, 07 Nov 2016 11:27:50 +0000
X-Env-Sender: sender at domain.com
X-Msg-Ref: server-12.tower-217.messagelabs.com!1478518069!63055818!1
X-Originating-IP: [1.2.3.4]
X-StarScan-Received:
X-StarScan-Version: 9.0.13; banners=-,-,-
X-VirusChecked: Checked
Received: (qmail 12279 invoked from network); 7 Nov 2016 11:27:49 -0000
Received: from mailserver.core.domain.com (HELO smtp.domain.com) (1.2.3.4)
  by server-12.tower-217.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 7 Nov 2016 11:27:49 -0000
X-Spam-Status: No
X-ObfuscatedOrg-MailScanner-Watermark: 1479122774.1594 at isZRSJkNKmb8yF20npzFJw
Subject: double space at beginning an end
X-ObfuscatedOrg-MailScanner-From: sender at domain.com
X-ObfuscatedOrg-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
	score=-0.999, required 6, ALL_TRUSTED -1.00, HTML_MESSAGE 0.00)
X-ObfuscatedOrg-MailScanner: Found to be clean
X-ObfuscatedOrg-MailScanner-ID: 1c3i45-0002bU-SE
X-ObfuscatedOrg-MailScanner-Information: Please report any suspicious emails to phishing at domain.com
Received: from [10.20.30.40] (port=39922 helo=MYEXCHANGEHUB.ad.domain.com)
	by smtp.domain.com with esmtps (TLSv1:AES128-SHA:128)
	(Exim 4.86)
	(envelope-from <sender at domain.com>)
	id 1c3i45-0002bU-SE
	for yahoo_recipient at yahoo.com; Mon, 07 Nov 2016 11:26:13 +0000
Received: from MYEXCHANGECCR.ad.domain.com ([169.254.1.220]) by
 MYEXCHANGEHUB.ad.domain.com ([10.20.30.40]) with mapi; Mon, 7 Nov 2016
 11:26:13 +0000
From: Warwick Brown <sender at domain.com>
To: "yahoo_recipient at yahoo.com" <yahoo_recipient at yahoo.com>
Date: Mon, 7 Nov 2016 11:26:12 +0000
Subject: double space at beginning an end  
Thread-Topic: double space at beginning an end  
Thread-Index: AdI46bzVFQGRGM8hSuyvNH7B9ZFnVA==
Message-ID: <B193F700BB84AD49A27D83F37C775F6203488C1803 at MYEXCHANGECCR.ad.domain.com>
Accept-Language: en-US, en-GB
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
acceptlanguage: en-US, en-GB
Content-Type: multipart/related;
	boundary="_004_B193F700BB84AD49A27D83F37C775F6203488C1803MYEXCHANGECCR_";
	type="multipart/alternative"
MIME-Version: 1.0
Content-Length: 13829

As can be seen - the subject inserted by outlook strips the leading whitespace but preserves the trailing whitespace. The subject added by MailScanner omits the trailing whitespace.

I can also confirm that there is no re-occurrence of the Subject: line in the absence of trailing spaces.

Hope this helps

Regards,

Warwick