You could also use: HEADERS 10 CONTAINS sapphirex John Tolmachoff Engineer/Consultant/Owner eServices For You
> -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Thursday, June 10, 2004 6:10 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Mail From Help > > > >I am wanting to block anything in the From line that says Sapphirex, so > >I created a filter called mail_from and it contains the following: > > > > > >MAILFROM 10 CONTRAINS Sapphirex > > > >But for some reason this was allowed through? I have a customer whom > >gets about 100 of these a day from Sapphirex with random email > >addresses? > > The problem is that the return address ("MAIL FROM") is: > > >X-Declude-Sender: [EMAIL PROTECTED] [64.136.98.37] > > if you use "MAILFROM 10 CONTAINS [EMAIL PROTECTED]" (or some > variation thereof), it should work. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > since 2000. > Declude Virus: Ultra reliable virus detection and the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
