--- a/src/dnsbl.cpp	Sat Dec 17 09:46:40 2016 -0800
+++ b/src/dnsbl.cpp	Sat Dec 17 13:47:28 2016 -0800
@@ -520,6 +520,8 @@
     ip                      = 0;
     helo                    = NULL;
     mailaddr                = NULL;
+    fromaddr                = NULL;
+    header_count            = 0;
     queueid                 = NULL;
     authenticated           = NULL;
     client_name             = NULL;
@@ -567,6 +569,7 @@
         delayer.pop_front();
     }
     if (mailaddr)        free((void*)mailaddr);
+    if (fromaddr)        free((void*)fromaddr);
     if (queueid)         free((void*)queueid);
     if (authenticated)   free((void*)authenticated);
     if (client_name)     free((void*)client_name);
@@ -582,6 +585,8 @@
         ctx                     = NULL;
         eom                     = false;
         mailaddr                = NULL;
+        fromaddr                = NULL;
+        header_count            = 0;
         queueid                 = NULL;
         authenticated           = NULL;
         client_name             = NULL;
@@ -1444,6 +1449,16 @@
 sfsistat mlfi_header(SMFICTX* ctx, char* headerf, char* headerv)
 {
     mlfiPriv &priv = *MLFIPRIV;
+    priv.header_count++;
+    if ((priv.header_count < 4) || (strcasecmp(headerf, "from") == 0)) {
+        char msg[maxlen];
+        snprintf(msg, sizeof(msg), "header %s: %s", headerf, headerv);
+        for (int i=0; i<strlen(msg); i++) {
+            if (msg[i] < 0x20) msg[i] = ' ';
+        }
+        my_syslog(&priv, msg);
+    }
+
     // headers that avoid autowhitelisting
     if (((strcasecmp(headerf, "precedence") == 0)   && (strcasecmp(headerv, "bulk") == 0)) ||
         ((strcasecmp(headerf, "content-type") == 0) && (strncasecmp(headerv, "multipart/report", 16) == 0))) {