Views:

In IMSVA the header_checks parameter can be used to check for RegEx patterns in the headers and either remove the entry entirely or modify it.

  1. Go to /opt/trend/imss/postfix/etc/postfix.
  2. Create a backup of the main.cf file by running the following command:

    cp main.cf main.cf.bak

  3. Create a new header_check file.
    • Run the following commands:
      • touch header_check
      • vi header_check
    • Enter the required regular expression to match and modify the desired headers:
  4. Open the main.cf file and add the following line below header_check:
    • header_checks = regexp:/opt/trend/imss/postfix/etc/postfix/header_check
  5. Save the changes and close the file.
  6. Run the following commands to restart Postfix:
    • postfix restart

There are 2 operators we can use in the header_check file:
  • IGNORE will remove the matched line from the email header
  • REPLACE will replace the matched pattern with the pattern following the REPLACE operator

To remove only the “Received” headers that contain the localhost 127.0.0.1 IP address:

#Header Checks File

/^Received:.*127\.0\.0\.1.*/ IGNORE

To remove headers that contain the domain trend.local and 127.0.0.1, you would use:

/^Received:.*\.trend\.local.*127\.0\.0\.1.*/ IGNORE

 

Some customers have found that the presence of 'unknown' in the Received headers can cause certain environments to reject incoming messages. To remove the word unknown from the header

Received: from parent.hostname.com (unknown [127.0.0.1])
    by IMSVA (Postfix) with ESMTP id 5F67820D8
    for <administrator@trend.local>; Thu,  25 Feb 2021 14:38:06 +0000 (GMT)

you could add the line below to the header_check file:

/^Received: from (.*\.hostname\.com) \(unknown (.*)/ REPLACE Received: from $1 ($2

This would replace the above header with 

Received: from parent.hostname.com ([127.0.0.1])
     by IMSVA (Postfix) with ESMTP id 5F67820D8     
     for <administrator@trend.local>; Thu,  25 Feb 2021 14:38:06 +0000 (GMT)

  • In some environments the client hostname of the sender could be included in the header, and this is of course private information, which the sender may wish to withhold. The header could be removed with the IGNORE operator as already shown, but the first Received header after the From header has significance for DKIM signing so it may be necessary to maintain the header, but remove the sensitive data. The RegEx below will replace pc.trend.local
/^Received:.*trend\.local.*(Mon|Tue|Wed|Thu|Fri|Sat|Sun)(.*)/ REPLACE Received: from NotAPC.trend.local (NotAPC.trend.local [10.10.10.10]) by mx1.trend.local; $1$2

This would replace the header:
Received: from pc1.trend.local (unknown [192.168.1.10])
    by parent.hostname.com (Postfix) with ESMTP
    for <administrator@trend.local>; Thu,  25 Feb 2021 14:38:06 +0000 (GMT)
With
Received: from NotAPC.trend.local (NotAPC.trend.local [10.10.10.10])
    by mx1.trend.local;
    for <administrator@trend.local>; Thu,  25 Feb 2021 14:38:06 +0000 (GMT)

Keywords: Remove Modify Received localhost private Headers in Interscan Messaging Security Virtual Appliance (IMSVA)