vitas1@itera.ru writes:

> So, as I've found in RFC's all header fields in message should
> be encoded to 7-bit data.


s/should/must/


> In addition my SMTP server does *not* support 8-bit MIME for
> incoming e-mail.


That's very uncommon and lot of mail will be probably rejected
due to this.


> The question is in subject - or am I missed some *legal* usage
> of 8-bit characters (maybe some kind of comments, optional
> fields, etc)?


Without extensions (RFC 1652), 8-bit in SMTP body is illegal.


> Of course, the goal is to write the rule for SA that will
> trigger on 8-bit symbols in raw ("raw"="what I've seen in
> tcpdump output for this message") message.


fwiw, sendmail has

| O EightBitMode=strict

rule. See

https://www.cvg.de/people/ensc/sendmail-8hdr.txt

for a rule to check headers.



Enrico