On Dec 20, 2018, at 7:49 PM, Grant Taylor <gtay...@tnetconsulting.net> wrote: > > So here's the user parts (left hand side of the @) of emails.
Are these in the From: header or the envelope-from (Return-Path)? Some of the ones with equal-signs look like bounce addresses from envelopes, that would not be in the From header. Or did you just look for any email address, so these could include Reply-To and emails in the body? In general it looks like you do have a bunch that would hit on even the multi-letter rule... but if they're envelopes or destinations (not From:) then they wouldn't be searched in this rule. Cheers and thanks. --- Amir
