Title. I have these filters set and they aren’t flagging the emails.

Everything else works as far as I can tell.

This issue fixed itself after clearing all of the filters and trying again.

Have something to say?

Join the community by quickly registering to participate in this discussion. We'd like to see you joining our great moo-community!

Is the FROM field under sogo filters case sensitive?

I have setup multiple filters based on different FROM addresses, each one setup to flag mail based on sender and the reason. IE. Bills.

However, when multiple filter rules are in place… it doesn’t flag them.

Edit: Works when its just one filter.

5 months later

I’ve been trying to get a SoGo filter to work, too. I keep adding conditions to this single rule and it simply doesn’t perform. (Note I’ve set it to “…any of…”.) But the messages keep showing up in my inbox and keep dinging my IMAP client.

    CaptainPalapa Is that your mailcow domain? then its probably because its whitelisted by default within mailcow

    I have similar rules and they work.

      Redacted a couple of domains and IPs, but that should be okay; not part of the Filter.

      Delivered-To: will@REDACTED.COM
      Received: from mail.MYMAILSERVER.NET ([172.22.1.253])
      	by 8009f5512e1b with LMTP
      	id MGgFA4bg2Wf0FwYAZzgOIA
      	(envelope-from <us.seo.ranking+bncBDS4H275YYORBP6A467AMGQE34AENJA@whitelabeledppc.com>)
      	for <will@REDACTED.COM>; Tue, 18 Mar 2025 16:07:18 -0500
      X-Original-To: will@REDACTED.COM
      Received: from mail-yb1-f200.google.com (mail-yb1-f200.google.com [209.85.219.200])
      	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
      	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
      	(No client certificate requested)
      	by mail.MYMAILSERVER.NET (Postcow) with ESMTPS id 886CE9D610
      	for <will@REDACTED.COM>; Tue, 18 Mar 2025 16:07:13 -0500 (CDT)
      Authentication-Results: mail.MYMAILSERVER.NET;
      	dkim=pass header.d=whitelabeledppc.com header.s=google header.b=bGWPV49D;
      	spf=none (mail.MYMAILSERVER.NET: domain of us.seo.ranking+bncBDS4H275YYORBP6A467AMGQE34AENJA@whitelabeledppc.com has no SPF policy when checking 209.85.219.200) smtp.mailfrom=us.seo.ranking+bncBDS4H275YYORBP6A467AMGQE34AENJA@whitelabeledppc.com;
      	dmarc=fail reason="No valid SPF, DKIM not aligned (relaxed)" header.from=zoro.com (policy=none);
      	arc=pass ("google.com:s=arc-20240605:i=2")
      ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed;
      	d=REDACTED.COM; s=dkim; t=1742332033;
      	h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date:
      	 message-id:message-id:to:to:cc:mime-version:mime-version:
      	 content-type:content-type:
      	 content-transfer-encoding:content-transfer-encoding:list-id:list-help:
      	 list-unsubscribe:list-post:dkim-signature;
      	bh=OHZEKTy5H1Fd7nj217ibk6V5LTArNDTgLkqzploQN58=;
      	b=UEqKNJokI2O+yldqwmX3uMQW9LvIt/WBcFn4g/+D6Vh5HWKoRPDPo+d0WHpxMfRKRJz5FO
      	fPIrSqc1FLQczXdTuYe7o+yAP8fXq5VV16+p1JVBYHMj6/waCPuQf4qfpsl7GfoECDr9yn
      	dBgQSSd82u+z1HcPtGAyXzmRfgyNnT096byzuJvsIlhszMVsT1qc3FjX9xkU8uQlWSgAvr
      	Cp/Pf0cQ6K7kwcC5URZWIJymXtgIWfU7eeIhUBr5LYkh6viLE/8B26s9mq92nOZXUJ2bxO
      	DJjRCmI6yeNrY19Ok3ndWcYyDRkS7AVziVlvkON4SftHapn0sQ6/RMdcUwEVng==
      ARC-Authentication-Results: i=3;
      	mail.MYMAILSERVER.NET;
      	dkim=pass header.d=whitelabeledppc.com header.s=google header.b=bGWPV49D;
      	spf=none (mail.MYMAILSERVER.NET: domain of us.seo.ranking+bncBDS4H275YYORBP6A467AMGQE34AENJA@whitelabeledppc.com has no SPF policy when checking 209.85.219.200) smtp.mailfrom=us.seo.ranking+bncBDS4H275YYORBP6A467AMGQE34AENJA@whitelabeledppc.com;
      	dmarc=fail reason="No valid SPF, DKIM not aligned (relaxed)" header.from=zoro.com (policy=none);
      	arc=pass ("google.com:s=arc-20240605:i=2")
      ARC-Seal: i=3; s=dkim; d=REDACTED.COM; t=1742332033; a=rsa-sha256;
      	cv=pass;
      	b=m9YhgTw+lArvvxkpC5iR4ErWtSQ6t6pQju4EzKhiYHp5Mb9DXDo7IcPyl3qhnRfgvCour9
      	tH1f9ES29QfBzMJfIFjqwMhH8kJrzKPR8BTZuFy6HtBP+0HnQk7dMdzrV6l/qyloE56QdE
      	bulKqA1VfE2boX+CJnqddgd6mNAiDAr5Cj4lXqwpM8VZ79bAvusZnPjbU7SpQ8rP2QohYK
      	Kguudipq/Ybenq12gkSuepHyRAa4SmaBb88YUMJCJqva9LoxUqIKJRZztwfnmnmaPQSm+n
      	M6Tut81nA4YTSVpCD73JX9APZr3ekF+PbgZ8Xe6kigyOP84IIZW+yoMfMI/OEQ==
      Received: by mail-yb1-f200.google.com with SMTP id 3f1490d57ef6-e63405c626asf6359288276.1
              for <will@REDACTED.COM>; Tue, 18 Mar 2025 14:07:13 -0700 (PDT)
      ARC-Seal: i=2; a=rsa-sha256; t=1742332033; cv=pass;
              d=google.com; s=arc-20240605;
              b=IPa3Hivw6s1RuNyIKBAcYUhZxAzvhrrZFcnL43mXjyfLj/2n/YWdaXtKq0SLolFB2I
               H2ifznwrnLfmsYcf7XPZEH6JocuWZsdrHrrnRk8mPYgINZ8quXbtaZCM5X+mf3MB7yhZ
               JlX/ZOMfA62Q7LRSYPxIULkSPRBMfuFKLJKPaSAMWMn5W8CAZRFtXIWi/hLFPOZwYtGh
               mc3Ag58wwN2WTRy0lNNm0GY1je96E/rxnhWrU6VNV6impbviHd4bRuslYOaZTbVBfDWb
               HwYLE6yojgcn576g0z0JmW6JT2Ne7lxOpQUY8V/fOR5EdyO7Wvi5okFRmjOKX3NkwEeG
               jbeA==
      ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
              h=list-unsubscribe:list-archive:list-help:list-post:list-id
               :mailing-list:precedence:content-transfer-encoding:mime-version
               :subject:message-id:to:reply-to:from:date:sender:dkim-signature;
              bh=OHZEKTy5H1Fd7nj217ibk6V5LTArNDTgLkqzploQN58=;
              fh=bib0j0sk1GAzp99ayex2MHQsIAoM7apvcZEdN6jvYfc=;
              b=VA4JdE5ZroW2XD16xQkhndf3C/e4lL7C8TjYY9DjeF1FKqElgqKuBemwVhMk0Bsanh
               oGhnYnq5I9Jy0IzdVJUb7ddFIwsnyZ8jVfZdi50+qOyMh37XNLItZmvzWi8gV6e4cJgq
               rG+ybdTkX95IQgw6Ghgqm9LUtN1T2BO/jXukrJaufLLJPcMkYKLJ/HSYO6cyuPT0AQcF
               gSZ9RBgqq7tVvtJXCrBtkAXXbDsJTx6DdkpgwooHCbhkJEkJhpJtR+rTyZwUmVgzAM76
               DXGrYwfyxA7Bqz+s0HWdm9XyiNxYbKAgOqxEwBgCQjhJP60bRz7XANunLiSiayt+ZyyN
               /nUA==;
              darn=REDACTED.COM
      ARC-Authentication-Results: i=2; mx.google.com;
             dkim=pass header.i=@zoro.com header.s=selector1 header.b=l7jAZPO6;
             spf=pass (google.com: domain of msprvs1=20172zcm93own=bounces-183799-1@bounces.sp.netsuite.com designates 192.174.81.16 as permitted sender) smtp.mailfrom="msprvs1=20172ZCM93oWn=bounces-183799-1@bounces.sp.netsuite.com";
             dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=zoro.com
      DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
              d=whitelabeledppc.com; s=google; t=1742332033; x=1742936833; darn=REDACTED.COM;
              h=list-unsubscribe:list-archive:list-help:list-post:list-id
               :mailing-list:precedence:x-original-authentication-results
               :x-original-sender:content-transfer-encoding:mime-version:subject
               :message-id:to:reply-to:from:date:sender:from:to:cc:subject:date
               :message-id:reply-to;
              bh=OHZEKTy5H1Fd7nj217ibk6V5LTArNDTgLkqzploQN58=;
              b=bGWPV49DRzUtkq/qupJvJc+vNyD0QsDoM2vHyw7GRG+W8nhj3VcHo3NYy738AmdLy+
               g9kyswOjqoBhIYzDGoQkHuF3Wg7qPKtIfGiI2oqxotAtcfi4DK7H6CzO20sZxR+eRcHM
               6kiO1ANVKYr4zBxp/HZZYwGWseFYlSBPO94UfKumXfymwNaygGXR/E0+vjHFaxS7Rb1P
               sAvKy6TpIp9LtSrc276violHUyG69ICUmnbowos5jAQ4lEt7tht8jj/0HgdYqQWTn/Vw
               dR40A3GSNRmWPaS9YtSXxYOnjtn2HDI+lKj/tuiQGJYGDNJeo8oJWzNFX0XW/Tej/3EP
               wohQ==
      X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
              d=1e100.net; s=20230601; t=1742332033; x=1742936833;
              h=list-unsubscribe:list-archive:list-help:list-post
               :x-spam-checked-in-group:list-id:mailing-list:precedence
               :x-original-authentication-results:x-original-sender
               :content-transfer-encoding:mime-version:subject:message-id:to
               :reply-to:from:date:x-beenthere:x-gm-message-state:sender:from:to:cc
               :subject:date:message-id:reply-to;
              bh=OHZEKTy5H1Fd7nj217ibk6V5LTArNDTgLkqzploQN58=;
              b=S6ff/AcXWmMeqV33AS1nx7qRx8TSEHqKwNASfKpVH8JY0J7/QmW8Z3iifhTCdVi11h
               LMM4221oUWfVdjW6KKR+0EI+n9E+0rEG3W4XWOS/nnxVA3ZH9M9FxwMNi2N+/SgOe2i1
               XvyEGgE3Z5Yuf3mSsYmvMJYo0M2P+5lxvcNZ1JeA9TXZFiUyjr5WmQxX007dJD7GXIOV
               iDrLW6VifVtMWqh+u21ZppA++/gGyhuAfWcpi5b2BJqzh/mmGWGvAsdJ8wNvMK3vF4Aw
               iuSYQ4RUZlhA+mUs/LMQxfzLZ3wpmjspZx1DO1Czv7s6AYaTvov1Uzk4OQDHpya0kaBw
               tMvg==
      Sender: us.seo.ranking@whitelabeledppc.com
      X-Forwarded-Encrypted: i=2; AJvYcCUp2q7tHL5CrCi8OywTTyjzTQQsnXslBLDHoLmL/RD6pIkW+DxkoRd+KZ7CruWTF6SGT6eT@REDACTED.COM
      X-Gm-Message-State: AOJu0YzNiQgVrA9z5VT19fn0YDVu8Y29rBIc0tMslkmN/Lg6Kg8ddWQJ
      	/O7RpA0EmmdbThnslU2AsmpX0Dr2g5+BILO5hJNVe021L5vI9eQdBu6v5/T00yw=
      X-Google-Smtp-Source: AGHT+IGBMnO3z/q6/3jRLG7AW57QMAMEjJH7oEHEqCsIJ9QbZQG8zI1KfWrabp2bHHwGxCCLmkkKHw==
      X-Received: by 2002:a05:6902:1b10:b0:e64:cd91:9c69 with SMTP id 3f1490d57ef6-e667b3f650bmr333950276.29.1742332032954;
              Tue, 18 Mar 2025 14:07:12 -0700 (PDT)
      X-BeenThere: us.seo.ranking@whitelabeledppc.com; h=ARLLPALVN3hEgvRkQAnCp/5MYrXtJT9+Q5ODqHkSIPnrIaNR0Q==
      Received: by 2002:a25:e4c2:0:b0:e60:873d:ae8f with SMTP id 3f1490d57ef6-e63dc3d6812ls24332276.2.-pod-prod-09-us;
       Tue, 18 Mar 2025 14:06:07 -0700 (PDT)
      X-Received: by 2002:a05:690c:700d:b0:6fb:968b:d8f5 with SMTP id 00721157ae682-7009c1699ebmr5183557b3.36.1742331967074;
              Tue, 18 Mar 2025 14:06:07 -0700 (PDT)
      ARC-Seal: i=1; a=rsa-sha256; t=1742331967; cv=none;
              d=google.com; s=arc-20240605;
              b=ebI3wkTeuwlSKNCpfCk8uS3wVTlom3jyo+/dhDf23NfgVgE66Hm+DiG/C4KLTu/iwD
               YbXPRBwkj2w52/miU2gMZ7r2JtiL7oY4Yy/sAusHqTPXsix8g/COu1j1X9OW/JmC/9b+
               7dyYmzYQJRloTjfmJF11sL6ysqZvZkp5Ni8+CEtemAIel12Jp8m384z3My2brZFTph5M
               0rfz01/LrfeLvM8lBM+rMBt59GG47wFXhAonJsVBqXY89vrq1iq59L9TrhatVHpZYdBS
               NiZlYNXlzi3O3Sb+nRad9SKRXq0OyL8EY6sfzJEqaojrk+kv/wy9fIbjJAJbkefNamZq
               rM3g==
      ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
              h=content-transfer-encoding:mime-version:subject:message-id:to
               :reply-to:from:date:dkim-signature;
              bh=OHZEKTy5H1Fd7nj217ibk6V5LTArNDTgLkqzploQN58=;
              fh=uh/civbWrOdmdsgCWpPppdz1qYk81IhQYLii/8pK/ms=;
              b=LyaA6prM3sIeykn/iG8O2HFEp61JTi8XgKop6MjHPiWe8tSBUBdNBX2vgb4nghgZTA
               1Dkr4g6o+0JElbch9th74YBR0TPlXwhP+qHmsWL9g9N7HK0IHSE0HrLGTJvMBnJhk8uW
               OL1EVTpf6vLAA4NBr74goezH3NZezfcp7oGnPfzk91Fn+7xTsAiR+/aM7tr0ROV7RSBt
               V+TRgkxc6XgO0N+a6UR+XjmLwA5CzRgX2QwdIg2XNs7qwf9Itytkp64o6QhL2Qr7SVoD
               9gbUfbtLBlqnQ2cU7l+0/SXYeFBpmbPZiJk2uQB+aTjYVTIYP6S0TPmUv0p4Cc9weSZa
               vp1Q==;
              dara=google.com
      ARC-Authentication-Results: i=1; mx.google.com;
             dkim=pass header.i=@zoro.com header.s=selector1 header.b=l7jAZPO6;
             spf=pass (google.com: domain of msprvs1=20172zcm93own=bounces-183799-1@bounces.sp.netsuite.com designates 192.174.81.16 as permitted sender) smtp.mailfrom="msprvs1=20172ZCM93oWn=bounces-183799-1@bounces.sp.netsuite.com";
             dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=zoro.com
      Received: from mta-174-81-16.netsuite.com.sparkpostmail.com (mta-174-81-16.netsuite.com.sparkpostmail.com. [192.174.81.16])
              by mx.google.com with ESMTPS id 00721157ae682-6ff32c79c21si101290737b3.381.2025.03.18.14.06.06
              for <us.seo.ranking@whitelabeledppc.com>
              (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
              Tue, 18 Mar 2025 14:06:07 -0700 (PDT)
      Received-SPF: pass (google.com: domain of msprvs1=20172zcm93own=bounces-183799-1@bounces.sp.netsuite.com designates 192.174.81.16 as permitted sender) client-ip=192.174.81.16;
      X-MSFBL: LFx//VGaHOpLMD6q95r+PRAjzA438vvnGh38gUyWCK8=|eyJzdWJhY2NvdW50X2l
      	kIjoiMSIsImN1c3RvbWVyX2lkIjoiMTgzNzk5IiwiciI6InVzLnNlby5yYW5raW5
      	nQHdoaXRlbGFiZWxlZHBwYy5jb20iLCJ0ZW5hbnRfaWQiOiJzcGMiLCJtZXNzYWd
      	lX2lkIjoiNjdkMzNlZTBkOTY3MDdkNDI4MGUifQ==
      Received: from [129.146.88.28] ([129.146.88.28:16720] helo=mail-outbound002.prod-phx-na19.core.ns.internal)
      	by i-05e84d68789813be3.mta1vsmtp.sd.prd.sparkpost (envelope-from <envelopeFrom@bounces.sp.netsuite.com>)
      	(ecelerity 4.8.0.74368 r(msys-ecelerity:tags/4.8.0.17)) with ESMTPSA (cipher=AES-256-GCM) 
      	id E0/82-01762-E30E9D76; Tue, 18 Mar 2025 21:06:06 +0000
      Received: from netsuite-backend-liver226.prod-phx-na19.core.ns.internal (unknown [10.140.8.16])
      	by mail-outbound002.prod-phx-na19.core.ns.internal (Postfix) with ESMTP id 4B38280E4A
      	for <us.seo.ranking@whitelabeledppc.com>; Tue, 18 Mar 2025 14:06:06 -0700 (PDT)
      Date: Tue, 18 Mar 2025 14:06:06 -0700 (PDT)
      From: Zoro Auto-Reply <do-not-reply@zoro.com>
      Reply-To: Zoro Auto-Reply <messages.1326902.420529438.240ba045bd@1326902.email.netsuite.com>
      To: us.seo.ranking@whitelabeledppc.com
      Message-ID: <3qq4vdv252x191lew6g7mgr4yiekujacn0a1fjctt70pcaul83yi5ci5y2bp7fuk@netsuite.com>
      Subject: (Do Not Reply) Case # CASE5161164 Created: Re: (Do Not Reply) Case
       # CASE5161056 Created: Thank you for your inquiry [
       thread::cx-T3wroLVefrYsgzHu4azY:: ]
      MIME-Version: 1.0
      Content-Type: text/html; charset=UTF-8
      Content-Transfer-Encoding: quoted-printable
      X-NetSuite: c=1326902; s=netsuite.be.liver226.prod.phx.na19.core.ns.internal; v=2024.2.17; t=SuiteScript; ec=false
      X-Original-Sender: do-not-reply@zoro.com
      X-Original-Authentication-Results: mx.google.com;       dkim=pass
       header.i=@zoro.com header.s=selector1 header.b=l7jAZPO6;       spf=pass
       (google.com: domain of msprvs1=20172zcm93own=bounces-183799-1@bounces.sp.netsuite.com
       designates 192.174.81.16 as permitted sender) smtp.mailfrom="msprvs1=20172ZCM93oWn=bounces-183799-1@bounces.sp.netsuite.com";
             dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=zoro.com
      Precedence: list
      Mailing-list: list us.seo.ranking@whitelabeledppc.com; contact us.seo.ranking+owners@whitelabeledppc.com
      List-ID: <us.seo.ranking.whitelabeledppc.com>
      X-Spam-Checked-In-Group: us.seo.ranking@whitelabeledppc.com
      X-Google-Group-Id: 455587058912
      List-Post: <https://groups.google.com/a/whitelabeledppc.com/group/us.seo.ranking/post>,
       <mailto:us.seo.ranking@whitelabeledppc.com>
      List-Help: <https://support.google.com/a/whitelabeledppc.com/bin/topic.py?topic=25838>,
       <mailto:us.seo.ranking+help@whitelabeledppc.com>
      List-Archive: <https://groups.google.com/a/whitelabeledppc.com/group/us.seo.ranking/>
      List-Unsubscribe: <mailto:googlegroups-manage+455587058912+unsubscribe@googlegroups.com>,
       <https://groups.google.com/a/whitelabeledppc.com/group/us.seo.ranking/subscribe>
      X-Last-TLS-Session-Version: TLSv1.3
      X-Rspamd-Queue-Id: 886CE9D610
      X-Spamd-Result: default: False [5.25 / 15.00];
      	FORGED_W_BAD_POLICY(3.00)[];
      	BAD_REP_POLICIES(2.00)[];
      	RBL_SENDERSCORE_REPUT_7(0.50)[209.85.219.200:from];
      	IP_REPUTATION_HAM(-0.41)[asn: 15169(-0.40), country: US(-0.01), ip: 209.85.219.200(0.00)];
      	MIME_HTML_ONLY(0.20)[];
      	MAILLIST(-0.20)[googlegroups];
      	DMARC_POLICY_SOFTFAIL(0.10)[zoro.com : No valid SPF, DKIM not aligned (relaxed),none];
      	BAYES_SPAM(0.08)[60.07%];
      	MX_GOOD(-0.01)[];
      	HAS_LIST_UNSUB(-0.01)[];
      	R_DKIM_ALLOW(0.00)[whitelabeledppc.com:s=google];
      	TAGGED_FROM(0.00)[bncBDS4H275YYORBP6A467AMGQE34AENJA];
      	RCVD_TLS_LAST(0.00)[];
      	BCC(0.00)[];
      	RCPT_COUNT_ONE(0.00)[1];
      	RCVD_IN_DNSWL_NONE(0.00)[129.146.88.28:received,209.85.219.200:from];
      	RCPT_MAILCOW_DOMAIN(0.00)[REDACTED.COM];
      	ARC_SIGNED(0.00)[REDACTED.COM:s=dkim:i=3];
      	FORGED_SENDER(0.00)[do-not-reply@zoro.com,us.seo.ranking@whitelabeledppc.com];
      	MIME_TRACE(0.00)[0:~];
      	REPLYTO_DN_EQ_FROM_DN(0.00)[];
      	REPLYTO_DOM_NEQ_FROM_DOM(0.00)[];
      	REPLYTO_DOM_NEQ_TO_DOM(0.00)[];
      	TO_DN_NONE(0.00)[];
      	FORGED_SENDER_MAILLIST(0.00)[];
      	RWL_MAILSPIKE_POSSIBLE(0.00)[209.85.219.200:from];
      	RCVD_COUNT_FIVE(0.00)[5];
      	FROM_HAS_DN(0.00)[];
      	FROM_NEQ_ENVFROM(0.00)[do-not-reply@zoro.com,us.seo.ranking@whitelabeledppc.com];
      	HAS_REPLYTO(0.00)[messages.1326902.420529438.240ba045bd@1326902.email.netsuite.com];
      	RCVD_VIA_SMTP_AUTH(0.00)[];
      	ASN(0.00)[asn:15169, ipnet:209.85.128.0/17, country:US];
      	DKIM_TRACE(0.00)[whitelabeledppc.com:+];
      	ARC_ALLOW(0.00)[google.com:s=arc-20240605:i=2];
      	FORGED_RECIPIENTS_MAILLIST(0.00)[];
      	MISSING_XM_UA(0.00)[];
      	RBL_NIXSPAM_FAIL(0.00)[209.85.219.200:server fail];
      	R_SPF_NA(0.00)[no SPF record]
      
      <HTML><HEAD><BASE href=3D'https://1326902.app.netsuite.com/'><meta http-equ=
      iv=3D"Content-Type" content=3D"text/html; charset=3DUTF-8"></HEAD><BODY sty=
      le=3D"font-family:Verdana,Arial,Helvetica,sans-serif;font-size:10pt;"><p><i=
      mg src=3D"https://1326902.app.netsuite.com/core/media/media.nl?id=3D5654055=
      5&amp;c=3D1326902&amp;h=3D4Di8ukX4V8lMoE0eKZUy7WRUhhud3zR5beA_e6di6Xu3SPgr"=
       /></p>
      <table border=3D"0" width=3D"100%" cellspacing=3D"2" cellpadding=3D"2">
      <tbody>
      <tr valign=3D"top">
      <td colspan=3D"2" valign=3D"top">
      <p><span style=3D"font-family: arial,helvetica,sans-serif;"><span style=3D"=
      font-size: 12px;"><span style=3D"font-family: -apple-system, BlinkMacSystem=
      Font, Segoe UI, Roboto, Oxygen, Ubuntu, Cantarell, Open Sans, Helvetica Neu=
      e, sans-serif; font-size: medium;">Thank you for contacting&nbsp;<span styl=
      e=3D"background-color: rgb(255, 255, 255);">Zoro&nbsp;</span>Customer Suppo=
      rt.<br /><br />Your request for assistance has been received. &nbsp;Case # =
      CASE5161164 - "</span>Re: (Do Not Reply) Case # CASE5161056 Created: Thank =
      you for your inquiry [ thread::cx-T3wroLVefrYsgzHu4azY:: ]<span style=3D"fo=
      nt-family: -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Oxygen, Ubu=
      ntu, Cantarell, Open Sans, Helvetica Neue, sans-serif; font-size: medium;">=
      " has been created for you. &nbsp;We will respond to your case within 24-48=
       hours.&nbsp;<br /><br />If this is an urgent matter or related to expedite=
      d delivery, please contact our customer service department by telephone at =
      855.BUY.ZORO (855.289.9676). &nbsp;Our customer service hours are Monday th=
      rough Friday from 6:00 am to 9:00 pm (CT) and Saturday from 7:00 am to 5:00=
      &nbsp;pm (CT).<br /><br /><span style=3D"background-color: rgb(255, 255, 25=
      5);">If you have an online customer account with us,&nbsp;</span><a style=
      =3D"font-family: arial, helvetica, sans-serif; background-color: rgb(255, 2=
      55, 255);" href=3D"https://checkout.zoro.com/myaccount/index.ssp?sc=3D6&ext=
      =3DT#/cases">click here to update your case online.</a><span style=3D"backg=
      round-color: rgb(255, 255, 255);">&nbsp; Please log in&nbsp;and go to Cases=
       &gt; All My Cases.</span><br /><br /><br />This is an automated email mess=
      age. &nbsp;Please do not respond to this email.</span></span></span></p>
      </td>
      </tr>
      </tbody>
      </table></BODY></HTML>```
      
      @"esackbauer"#p22985 No, that "whitelabeledppc" is part of whatever scam/world-burn operation is going on.  Somehow my email address is tied to it, along with others at any given time.  They reply "please stop", and it ends up coming to me somehow, and usually with a bunch of support ticket auto-replies.
      
      @"esackbauer"#p22985 No, that "whitelabeledppc" is part of whatever scam/world-burn operation is going on.  Somehow my email address is tied to it, along with others at any given time.  They reply "please stop", and it ends up coming to me somehow, and usually with a bunch of support ticket auto-replies.
      
      @"esackbauer"#p22985 No, that "whitelabeledppc" is part of whatever scam/world-burn operation is going on.  Somehow my email address is tied to it, along with others at any given time.  They reply "please stop", and it ends up coming to me somehow, and usually with a bunch of support ticket auto-replies.
      
      (And @"DocFraggle"#1599, sorry, my straight Reply click on esackbauer's message added to the bottom of the content in my original reply to you.  Twice.  Because "an error occurred" so I tried again.  Until I remembered that's a frequent glitch (for me) when I use this forum.  I think as "last replier", and more replies get tacked on as an edit.

      OK, so “whitelabeledppc.com” is NOT contained in “From”, “Return-Path” and not in the body. It’s only contained in the “To” header.
      I’m not sure which header field the default “To” filter uses, maybe it’s not the “To” header but “Delivered-To”, which is your email address in this case.

      You could try to set the rule to

      Header To contains whitelabeledppc.com

        DocFraggle I will add that to the filter. By the way, I kept trying to add a reply this morning, but they kept appending to the bottom of that header content in my last reply. Bug or design flaw in this particular forum system.

        Came here just now (didn’t know you had yet replied), to add that it looks like I’m catching some, at least, with the Global Filter Maps:

        I’ve added /.+whitelabeledppc\.com/i to Header-From: Blacklist, Envelope Sender Blacklist, Recipient Blacklist and /Return-Path:\s.+whitelabeledppc\.com/i to Bad (Junk) Mail Headers

        The latter was based on seeing it frequently in the headers. I’ve actually paused the Filter (deactivated?) so I can continue testing these blacklist setups. (They’ll catch this nonsense for ALL users rather than just me if the others get entangled in this in the future.)

        Thanks for your help, y’all! 😃

        And for you, sir, since I have a clear reply path now that DocFraggle got in the middle, I hope. Won’t know until I hit Post Reply, but I suspect it’ll work:
        esackbauer No, that “whitelabeledppc” is part of whatever scam/world-burn operation is going on. Somehow my email address is tied to it, along with others at any given time. They reply “please stop”, and it ends up coming to me somehow, and usually with a bunch of support ticket auto-replies.

        No one is typing