Harry Putnam asked,
| How can one identify easily, messages coming from a .forward mechanism
| at a different address, in the case where no "To: " field is present?
... or a To: field that doesn't name you.
| Case in point: I have a different address at worldnet.att.net. I've
| arranged to have any mail sent there to be forwarded to my newsguy.com
| address. Not sure what mechanism is used since I only have access to
| a web interface that allows users to set forwarding. It doesn't
| specify the tools used. But I'm assuming .forward file.
If the topmost Received: header of mail you get at newsguy.com mentions
worldnet, then likely it was forwarded. Do you want to differentiate
it from mail that originates on worldnet? (Do you get any mail that
originates on worldnet?)
My first guess would be something like this, but it's probably not so great.
I'll have a better suggestion below.
# if it's addressed to worldnet, assume it was sent there (cheapo shortcut)
:0E: # otherwise
# see if there are at least three Received: headers to weed out mail that
# came straight from its source without forwarding
# suck up the topmost
# check it for any mention of worldnet
* MATCH ?? worldnet\.att\.net
# and file if there is
[Philip, is there a better way to write the first condition of the second
recipe? You completely lost me with your post about that.]
Better, I think, would be to forward your worldnet mail in such a way that
makes it identifiable. To you have plus-suffixing available on newsguy?
If so, you could change your .forward on worldnet to read something like
an address that nobody would write directly to or even learn about. Then
if newsguy adds a "for" clause in the Received: header that it adds, or if
the MTA or LDA on newsguy makes the suffix available for your .procmailrc
to spot, you'd have a foolproof way to identify mail forwarded from worldnet.