> So, as I've found in RFC's all header fields in message should
> be encoded to 7-bit data.


> In addition my SMTP server does *not* support 8-bit MIME for
> incoming e-mail.

That's very uncommon and lot of mail will be probably rejected
due to this.

> The question is in subject - or am I missed some *legal* usage
> of 8-bit characters (maybe some kind of comments, optional
> fields, etc)?

Without extensions (RFC 1652), 8-bit in SMTP body is illegal.

> Of course, the goal is to write the rule for SA that will
> trigger on 8-bit symbols in raw ("raw"="what I've seen in
> tcpdump output for this message") message.

fwiw, sendmail has

| O EightBitMode=strict

rule. See

for a rule to check headers.