Filter won't match based on "From:" field
Usually I can pick a characteristic of the "From:" field to identify some spam messages that I want to move to the Spam folder. But something is weird in a message I got today. In the list of messages I see when I open Thunderbird, the Correspondent field for this message is blank. When I press Ctrl/u and look at the source, I see the following From line:
From: The CHOICE Warranty <thechoicewarranty@darkoj.tools>
My filter has the following selection criteria: Match any of the following From - ends with - .tools
This was working on these garbage messages, but something is different with this message. I can't get any filter to match it. I also tried: From - ends with - .tools>
and From - contains - .tools
but these didn't work either. Maybe the filter doesn't even see the "From:" line because the "From:" in the source isn't showing up in the Correspondents field. Any suggestions appreciated.
Chosen solution
Experiment time.
Save the email as an eml file on your desktop. Open it in Notepad to edit Remove the space above the From: Save changes and double click to open in Thunderbird.
I think what is happening is Thunderbird thinks the header is complete because of that space. ie the email is malformed.
Read this answer in context 👍 1All Replies (5)
try enabling the from heading in your list. It is populating? What about the from in the header at the top of the message display?
Is there more than one From: header in the actual message source? (Ctrl+U to display) Note the first line will be From -and a date. I do not count that as it had no colon
Thanks for your suggestions! When I added the "From" column to the list of messages I see when I open Thunderbird, the From column was blank for this message. In the message display, the "From:" field is also missing. But the message display is odd since the "From:" line I see from the message source shows up in the message body. In case this helps, I've attached a screen shot of the message source as well as a screen shot of the message display.
Seçilmiş Həll
Experiment time.
Save the email as an eml file on your desktop. Open it in Notepad to edit Remove the space above the From: Save changes and double click to open in Thunderbird.
I think what is happening is Thunderbird thinks the header is complete because of that space. ie the email is malformed.
Bingo! Thanks so much. This puts the From information in the From field and the filter works like a charm.
While it is not ongoing help, it does explain the failure. Perhaps you need to look at the provider and see if they do spam filtering, but it would not surprise me to learn the spammer deliberately malformed the mail to defeat filters on the from field and the subject given so many apparently try and use them as spam tools.