I've found that by deleting all the "Received: from *outlook*" and "Received: from *hotmail*" lines, spamcop is once again able to process the headers correctly and send the spam report to the correct originating IP. This should only be a temporary workaround though. Spamcop should be able to cope with these headers, so I still need to know if I need to do anything for it to "learn" about these new headers. For example, without the strikethrough lines, the following report (somewhat shortened for brevity) is now sent to 220.127.116.11 (firstname.lastname@example.org) Received: from VE1EUR03HT037.eop-EUR03.prod.protection.outlook.com (2603:10a6:203:51::31) by AM5P192MB0210.EURP192.PROD.OUTLOOK.COM... Received: from VE1EUR03FT010.eop-EUR03.prod.protection.outlook.com (10.152.18.58) by VE1EUR03HT037.eop-EUR03.prod.protection.outlook.com (10.152.19.102)... Authentication-Results: spf=none (sender IP is 18.104.22.168) smtp.mailfrom=preparationresources.io; hotmail.com; dkim=none (message not signed) header.d=none;hotmail.com; dmarc=none action=none header.from=preparationresources.io; Received-SPF: None (protection.outlook.com: preparationresources.io does not designate permitted sender hosts) Received: from SNT004-MC2F10.hotmail.com (10.152.18.53) by VE1EUR03FT010.mail.protection.outlook.com (10.152.18.113)... X-IncomingTopHeaderMarker: OriginalChecksum:E3D3E6A... Received: from preparationresources.io ([22.214.171.124]) by SNT004-MC2F10.hotmail.com... Received: from unknown (126.96.36.199) by smtp.endend.nl with LOCAL... Received: from group21.345mail.com ([188.8.131.52]) by smtp.endend.nl with LOCAL...
Anyone got any more ideas on this? It is a big problem to me - I can no longer use spamcop to report originating email domains. Not at all. Every mail to my hotmail is being parsed as if it were coming from hotmail. I have also deleted and re-run mailhosts, but the problem remains. For each email it is using the *.prod.protection.outlook.com address (eg Received: from DB5EUR03HT094.eop-EUR03.prod.protection.outlook.com (2603:10a6:203:51::15) by AM5P192MB0210.EURP192.PROD.OUTLOOK.COM) and this IPv6 address links back to report_spam@hotmail. But further down the message source the real originating domain is revealed (eg Received: from unfructify.channelarea.com ([184.108.40.206]) by SNT004-MC4F23.hotmail.com). In this example I want to send my report to this "channelarea.com" address, but I can't. Could this be be something to do with them using an IPv6 "outlook" address instead of the IPv4 hotmail address to which mailhost is set? My email domain is Hotmail, so that's all I can do to run mailhosts. I've no doubt this is to do with a change Hotmail have put in place to protect their service and/or introduce IPv6 and/or merge more closely with Outlook. But what do I need to do to get spamcop to recognise the real source, and not the Outlook IPv6 through which the message has passed? Otherwise I can only use spamcop to report links within the emails, and not the source of those emails themselves. eg https://www.spamcop.net/sc?id=z6385911404zca09268f3113b1f740d7c4c4950a45a4z