If you have slurp your headers into a scalar, it's easy to chop it up into an array with multiline headers correctly stitched up together:

my $header = <<'HEADER'; Return-Path: <NITAIGOURANGA@AOL.COM> X-Original-To: grinder@example.com Delivered-To: grinder@example.com Received: from RX504Second (ACBC197E.ipt.aol.com []) by example.com (Postfix) with SMTP id C5960A94C for <grinder@example.com>; Mon, 30 Jun 2003 13:18:36 +0200 (CE +ST) From: "GOURANGA" <NITAIGOURANGA@AOL.COM> HEADER my @header = split /\n(?!\s+)/, $header;

You might want to post-process each element to fold whitespace as well. A module will probably do a better job, but I find tr/\n\t / /s is usually good enough for my needs.

Once you have your headers, I would suggest looking at the Return-Path: header, which holds the envelope sender of the message. I would also suggest you take a look at the Received: headers as well. These two items are very revealing when it comes to dealing with spew. The To: and From: headers are nearly always forged, or at least irrelevant, in spammers' messages.

Come to YAPC::Europe 2003 in Paris, 23-25 July 2003.

In reply to Re: Finding e-mail headers by grinder
in thread Finding e-mail headers by AssFace

Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post; it's "PerlMonks-approved HTML":