Question: What is IronPort-PHdr Mail Header?
Cisco Email Security Appliance (ESA aka Ironport) ver 9.6.0-042
ESA now has new feature called Gray Mail. Which classifies marketing, social media and bulk mailing and allows you to take an action for those mails.
The new IronPort-PHdr is added for Gray Mail classification. The value of the header is too long, you cannot miss it if you take look at the header!
Currently IronPort-PHdr is added by Out Break Filters NOT by Gray Mail feature. Which means Gray Mail works with Out Break Filter process although this is not documented. (For example URL Filter works with Out Break Filters too but this process is documented.)
And Out Break Filters applies after the content filters in e-mail pipeline process. That means, IronPort-PHdr header is added after content filter operations.
Email Pipeline Flows section on User Guide for AsyncOS 9.6 for Cisco
Email Security Appliances