Jump to content

couldn't parse head...again and again and again...


Recommended Posts

For the past few months whenever I try to report ANY spam, I get the dreaded "couldn't parse head" error when it gets to the body text.

The FAQ on this indicates this is a problem with Outlook and Eudora. I don't use either (I use PowerMail by CTMDev for Mac OS X), but have tried using the workaround form anyway. I get the same error. Have also tried forwarding the email as indicated, but get the same error. PowerMail does not have a function to forward the email as an attachment unfortunately, so cannot try that yet (considering simple cut-and-paste intothe forms has worked in the past, I don't think forwarding as an attachment would help either since something fundamental appears to have changed, but I can't figure out what). The rest of the FAQ indicates there may be something wrong with the indentation of my header lines, but there is no problem with those as far as I can see.

The amount of spam getting through both my SpamCop and SpamAssassin settings (set in SpamCop) has increased of late and I'm wondering if my reports are doing anything at all since they are not being fully parsed.

My question is, can someone explain to me more fully what I should be looking for in my headers to ensure that all will be parsed like they used to be? (I've been using PowerMail for several years now, the latest version of it well before this started with SpamCop, so I think something changed here, but am willing to try anything at any end of the chain to stop more spam. :) ) If posting a header will assist and people ask for one, I'll do so, but since this is happening with EVERY spam I have there is something more fundamental than just some spammers forging this or that, I think...

Link to comment
Share on other sites

Yes, sharing the headers wold be the only way to start for "us" to say anything. In the interim, you may want to try simply Forwarding one to yourself .. then compare that incoming to what you sent and see what all got changed. Then you'd want to try to figure out why it changed, or how to work around the changes .... that you say it's happening on "every" spam, then it does seem to point back at your system / configuration ...

Link to comment
Share on other sites

Yes, sharing the headers wold be the only way to start for "us" to say anything....

Excellent. Just wanted to ensure I had the right place to post before posting long headers of spam...

Here is a header from one of today's:

------------------ RFC822 Header Follows ------------------
Return-Path: <e_rosales_ax[at]cbn.net.id>
Delivered-To: _______[at]offbalance.com
Received: from c60.cesmail.net (c60.cesmail.net [])
	by thebe.your-site.com (Postfix) with ESMTP id F288D244B07
	for <_______[at]offbalance.com>; Thu, 26 Feb 2004 21:03:09 -0500 (EST)
Received: from unknown (HELO blade4.cesmail.net) (
  by c60.cesmail.net with SMTP; 26 Feb 2004 21:01:54 -0500
Received: (qmail 5418 invoked by uid 1010); 27 Feb 2004 02:01:52 -0000
Delivered-To: spamcop-net-offbalance[at]spamcop.net
Received: (qmail 4269 invoked from network); 27 Feb 2004 02:01:19 -0000
Received: from unknown (HELO mailgate.cesmail.net) (
  by blade4.cesmail.net with SMTP; 27 Feb 2004 02:01:19 -0000
Received: (qmail 21603 invoked from network); 27 Feb 2004 01:49:13 -0000
Received: from lists.your-site.com (HELO thebe.your-site.com) (
  by mailgate.cesmail.net with SMTP; 27 Feb 2004 01:49:13 -0000
Received: from arti.vub.ac.be (adsl-68-92-61-72.dsl.hstntx.swbell.net [])
	by thebe.your-site.com (Postfix) with ESMTP id F3580244B3B
	for <_______[at]offbalance.com>; Thu, 26 Feb 2004 20:50:26 -0500 (EST)
MIME-Version: 1.0
To: _______[at]offbalance.com
From: "Eugenia Rosales" <e_rosales_ax[at]cbn.net.id>
Subject: =?iso-8859-1?b?VHJ5IFZeaWFncmEsIGhhdmUgaXQgZGVsaXZlcmVkIHRvIHlvdXIgZG9vciEgTkVYVCBEQVk=?=
Message-ID: <1077846356.8262[at]cbn.net.id>
Date: Fri, 27 Feb 2004 01:45:56 +0000
X-Mailer: Pegasus Mail for Win32 (v3.12a)
Content-Type: multipart/alternative;
X-spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on blade4
X-spam-Level: **
X-spam-Status: hits=2.7 tests=HTML_50_60,HTML_IMAGE_ONLY_02,HTML_MESSAGE,

I don't think forwarding to myself would help much since I get the error in the parser whether I forward email or paste into the online forms. However I might do so just as an exercise in seeing what it looks like anyway.

Note the subject line is some weird ISO code. Not all the spams that give me the parsing error have subjects like that, obviously. Also, the first and 8th Received line doesn't appear indented here but it is when I paste it

Link to comment
Share on other sites

OK, I'm willing to do this, if only to stimulate someoen wiser than myself to straighten it out .... silly questions starting now ..

Where did the -----RFC line come from? I can easily say that if I tried to paste that into the parsing window, there'd be an error... and of course, same question for the line at the botom of your example

how much munging did you do to hese headers before posting? Your address delete is obvious, but all the unknown servers ... seems odd to me that there'd be that many un-named systems under JT's (?) control.

Think I'll just stop for now and wait for the above answers ...

Link to comment
Share on other sites

  • 2 years later...

Try using this (with your SpamCop address)



tell application "PowerMail"


set theMessages to the current messages

repeat with theMsg in theMessages

set forAddress to {"SpamCop Reporting <submit.YOURCODE[at]spam.spamcop.net>"}

set origSource to source of theMsg

set origHeaders to headers of theMsg

set msg to forward theMsg to forAddress

set content of msg to origHeaders & origSource

set status of msg to waiting

end repeat

end tell

end try


Link to comment
Share on other sites

Try using this (with your SpamCop address)

Thanks for the shot, but .... do you really think that the Topic starter is actually going to see it? Considering that it's been two years and the last question asked was never replied to ...????

Link to comment
Share on other sites


This topic is now archived and is closed to further replies.

  • Create New...