[kmike]

Looks like this hack is not supported anymore. Here are a few bug fixes for those who still care.

1. There's a bug in the regular expressions: all occurences of

RFC822;[ ]*[<]*(\S+@\S+)[>]?

should be replaced with

RFC822; *<?(\S+?@\S+?)>?\s*$

otherwise an email address scraped from this line: "Final-Recipient: RFC822; <xxxx@test.sg>" will include the final ">" ("xxx@test.sg>"). Apparently it affects all addresses at charter.net.

2. Next thing, sometimes members fill out their email in capital letters, but reporting MTA rewrites them in lower case, such as: "Final-Recipient: RFC822; USER@aol.com" for the user provided "USER@AOL.COM", so md5 check of USER@aol.com will be against md5-encoded USER@AOL.COM and a bounce will be reported as forged when it's in fact not.
The solution: strtolower() member email address before sending and also strtolower() before checking them against X-Return-ID.

3. Finally, the recipient email address may be an alias for the different account. In this case "Final-Recipient" line will include that another email address instead, and the check for the forged bounces will fail. This one is tough to correct. It is amended by adding another custom header with an original email address and checking md5 against it and not the one scraped from a "Final-Recipient" line. But obviously this is a bit more prone to the errors and the possible forging though.