MHA icon indicating copy to clipboard operation
MHA copied to clipboard
verified publisher icon microsoft

Add DIR to Forefront Antispam Report header

Open sevmonster opened this issue 5 years ago • 1 comments

Does not appear to be documented, but I am seeing it on emails. DIR seems to be set to either INB for inbound and OUT for outbound. Right now it shows up under Unknown fields.

sevmonster avatar Sep 30 '20 15:09 sevmonster

Until we have some sort of documentation for it I'd only be guessing. I did work to make sure that unknown fields like that get rendered somewhere so analysts still have access to them

stephenegriffin avatar Sep 30 '20 17:09 stephenegriffin