Function written_on_arrival 

fn written_on_arrival(headers: &RawHeaders) -> RawHeaders

The fields your provider wrote on a message once it took it in, top to bottom: those above the Received line where it came in from the Internet.

Each server adds its lines on top of what it is handed (RFC 5321 §4.4), so whatever a sender wrote, its own servers’ lines included, lies below that line, and nothing above it is theirs. Walking down from the top, the provider’s own hops are passed: a line without from (a server handing the message to itself), one from a private or local address (a filter, an antivirus, the next server inside), the delivery into the mailbox (LMTP: Dovecot and Cyrus add their line on top of the filters’ verdicts). The walk stops at the first line from a public address, where the message came in, or at one it cannot read (an address written another way): the fields above it are the provider’s. Sioul’s own results, on the very top, are neither a line nor a verdict. Mail that never came from outside (only private addresses) ends at its lowest Received; mail without any (copied into the mailbox, never delivered) has nothing of its provider’s. A filter that adds its verdict at the bottom of the block, or just below the line where the message came in, cannot be told from the sender: its verdict is not read.