How to filter based on "Sender" header?
I have Google Calendar notifications coming in and I want to whitelist them from the rest of my email filters. But the only distinguishing feature is the Sender: header. But if i try to filter on "Any header" it's not working. What is wrong here?
Sample Filter
"Any Header" "matches regex" "Sender\: Google Calendar <calendar-notification@google.com>"
i have also tried
"Any Header" "contains" "calendar-notification@google.com"
Sample Header
Reply-To: Jane Doe <jdoe2@coursevector.com>
Sender: Google Calendar <calendar-notification@google.com>
Message-ID: <calendar-uuid@google.com>
Date: Thu, 10 Apr 2025 13:39:10 +0000
Subject: =?UTF-8?Q?Invitation=3A_email_subject__=40_Thu_Apr_10=2C_2?=
=?UTF-8?Q?025_12pm_=2D_12=3A30pm_=28EDT=29_=28John_Doe=29?=
From: Jane Doe <jdoe2@coursevector.com>
To: =?UTF-8?Q?John_Doe?= <jdoe@coursevector.com>
Why doesn't it match? The Sender header is about 5kb into the email, so it should be well within what is read. I think Exim reads up to the first 1Mib of headers.
-
Hey there! Just like you, I would also expect that to match. Do you see any data in the Exim log (/var/log/exim_mainlog) that shows anything interesting regarding the filtering?
0 -
No i don't see anything relevant. Here is an incoming event cancellation:
2025-04-09 09:10:37 1u2VCP-00000005SF3-32ne <= jdoe@coursevector.com H=spam-filter.coursevector.com [111.11.111.111]:33294 P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=24766 id=calendar-uuid@google.com T="Appointment canceled: Training Session - 60 min (Sally Simmons) @ Wed Apr 9, 2025 9am - 10am" for jdoe@coursevector.com
2025-04-09 09:10:37 SMTP connection from spam-filter.coursevector.com [111.11.111.111]:33294 D=40s closed by QUIT
2025-04-09 09:10:37 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1u2VCP-00000005SF3-32ne
2025-04-09 09:10:37 1u2VCP-00000005SF3-32ne => filtered_junk ("filtered_junk"@coursevector.com, "filtered_junk"@coursevector.com, jdoe@coursevector.com) <jdoe@coursevector.com> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <filtered_junk@coursevector.com> GASdMs1x9mdX0xMAR1vlLw Saved"
2025-04-09 09:10:37 1u2VCP-00000005SF3-32ne => filtered_junk ("filtered_junk"@coursevector.com, jdoe@coursevector.com) <jdoe@coursevector.com> R=archive_incoming_email_domain_method T=archiver_incoming_domain_method
2025-04-09 09:10:37 1u2VCP-00000005SF3-32ne => jdoe <jdoe@coursevector.com> R=archive_incoming_email_domain_method T=archiver_incoming_domain_method
2025-04-09 09:10:37 1u2VCP-00000005SF3-32ne Completed0 -
Is that header possibly being added by the mail sender? I don't see the 'sender' header in a test message I just sent from a Yahoo account to my cPanel server, so I'm just wondering if the system isn't recognizing that header.
0 -
I don't think so, but i have no way to confirm either way. These are notifications coming from Google Calendar for meeting invites that were added/modified/canceled and notifying who is involved with the meeting. The headers I gave you were directly from roundcube after they were received by the server, so it SHOULD be as close to the raw received email as I can get. But even if i copy and paste that same raw email into the filter tested in cPanel, it still fails to recognize it.
0 -
That's odd for sure - could you open a ticket so this can be investigated?
0 -
Done, #95679080
0 -
Thanks for that - at this point it looks like we're waiting on access to the server.
0
Please sign in to leave a comment.
Comments
7 comments