Ok, I thought I'd give SpamCop a try. I expanded the headers of the spam, and forwarded it to spamcop at spamcop.net . Got this niffy autoresponse back. > Subject: SpamCop has accepted 1 email for processing > > SpamCop is now ready to process your spam. > > Note: Please use spam at cmds.spamcop.net instead of spamcop at spamcop.net. > > Members should use these links: > http://members.spamcop.net/sc?tid=z25143423z67ed3781865afb2bd7bf098cc6861996z > > Non-Members must use these links: > http://spamcop.net/sc?id=z25143423z67ed3781865afb2bd7bf098cc6861996z Went to the non-member url and I get this message. Saved email: This page may be saved for future reference: http://spamcop.net/sc?id=z25143423z67ed3781865afb2bd7bf098cc6861996z Guessing end of header is here:> For more accurate results, please deliniate body with an empty line Parsing header: No source IP address found, cannot proceed. Not full header? No tracking information found in header: > Return-Path: <mailer at mail15.transcentives.net> Probably not full headers - see FAQ: Email software FAQ no header Would send message source reports to: Cookie option allows additional reporting in this space. Looking at the FAQ, I do have unset forward_decode in my rc file. What gives? -- Bob Tanner <tanner at real-time.com> | Phone : (952)943-8700 http://www.mn-linux.org, Minnesota, Linux | Fax : (952)943-8500 Key fingerprint = 6C E9 51 4F D5 3E 4C 66 62 A9 10 E5 35 85 39 D9