After upgrading to iRedMail EE v1.7.4 we started seeing large numbers of legitimate outbound emails from Outlook clients (versions 14/15/16) being blocked with BAD-HEADER-0 and quarantined with BAD-HEADER-5.

ROOT CAUSE

v1.7.4 switched Amavis from content_filter mode to milter mode (amavisd-milter). In milter mode, Amavis sees raw unprocessed headers directly from the mail client before any Postfix normalisation. Outlook generates RFC-imperfect but universally accepted headers (long reply-chain headers, non-standard Message-IDs) that now trigger BAD-HEADER checks that previously never fired.

THE FIX

In the EE web UI, go to Server Settings -> Spam Policy -> Enable bad-header checking, and switch the sub-option to "Deliver bad-header email to mailbox". This stores the setting in the SQL database and survives future upgrades.

Note: bad_header_lovers_maps => [1] alone is not sufficient — bypass_header_checks_maps => [1] is also needed to stop BAD-HEADER-5 quarantining. The web UI option handles both.

Thanks to Zhang for confirming the fix and advising that both parameters will be included as defaults in the next EE release.