For the vast majority of spam email I receive, the sender is in quotes. i.e. "SpamJerk". I have tried to create a rule in Mail to filter anything that begins or ends with a quotation mark without success. Any suggestions on how to have the filter recognize this situation?
From: email headers dynamically change to reflect the spam campaign de jure, so attempting to write a single rule to catch them is futile. Wildcards are no supported in Mail rules so "*" won't work. I focus on the Return-Path header field as that is always the mail server used as a transit point which spammers can establish accounts on and forward their originating email through.
In your list of Mail messages, select a single message that you want to filter, then…
In Mail Preferences > Rules, edit your existing rule list, or create a new one. When you click on the default From header field selector, there is a list of alternative fields you can use. At the very bottom of this is is a menu item, Edit Header list… Select that, and add Return-Path to your Header list, exactly as shown. This will now appear near among the selectable items, and select Return-Path. The rule will look like this:
if [any] of the following conditions are met:
[Return-Path] [contains] [ automatically fills in with the return path server address]
Perform the following actions:
[Move Message] to mailbox: [Trash]
In that filled in field on the right above, it will be a long string. Use your arrow key to move to the extreme right of that string, and then start backspacing until you get to the domain name (e.g. @FreshOffThePress.org) and remove everything before that domain name so your rule will act on any email from @FreshOffThePress.org. Once you click OK to save the rule, a dialog will pop open asking to act on the selected email. When you agree, you will see that SPAM disappear from your inbox, and future emails from that Return-Path will automatically get whacked too.
From: email headers dynamically change to reflect the spam campaign de jure, so attempting to write a single rule to catch them is futile. Wildcards are no supported in Mail rules so "*" won't work. I focus on the Return-Path header field as that is always the mail server used as a transit point which spammers can establish accounts on and forward their originating email through.
In your list of Mail messages, select a single message that you want to filter, then…
In Mail Preferences > Rules, edit your existing rule list, or create a new one. When you click on the default From header field selector, there is a list of alternative fields you can use. At the very bottom of this is is a menu item, Edit Header list… Select that, and add Return-Path to your Header list, exactly as shown. This will now appear near among the selectable items, and select Return-Path. The rule will look like this:
if [any] of the following conditions are met:
[Return-Path] [contains] [ automatically fills in with the return path server address]
Perform the following actions:
[Move Message] to mailbox: [Trash]
In that filled in field on the right above, it will be a long string. Use your arrow key to move to the extreme right of that string, and then start backspacing until you get to the domain name (e.g. @FreshOffThePress.org) and remove everything before that domain name so your rule will act on any email from @FreshOffThePress.org. Once you click OK to save the rule, a dialog will pop open asking to act on the selected email. When you agree, you will see that SPAM disappear from your inbox, and future emails from that Return-Path will automatically get whacked too.
Thank you for the response. I had actually tried exactly what you suggest but apparently the rule as shown does not recognize a quotation mark. I tried several variations such as "Begins with", "ends with" with no better success. You are correct, only spam emails include the quotation marks and would have caught 100% of the junk. Limitation of the program?
Thanks again.
Thank you,
This is working but it is a fairly extensive list already. 15 and counting. It will be interesting to see how many and what frequency new mail servers continue to show up. Another house keeping chore but once set up as you described, it should be simple to maintain.
Much appreciated.
You are welcome.
There can be many spam campaigns using different accounts on the same Return-Path server, or from different Return-Path address servers. If the spammers own their own servers, they may change the domain name in the server address by as little as one letter to cause us to create another rule, and eventually, they may change Return-Path servers too.
I have one Mail rule that has 40 individual Return-Path addresses that are trimmed down to just the specific domain name. Apparently, there are no end to spammers or those that put our email addresses out on the dark web for sale to these miscreants.
At some point (months) I may delete the Mail rule, and see what spam comes in, and eventually I end up with far fewer rule entries as some of the tracked spam sources are no longer sending to me, or as I have noted, using a different Return-Path server.
Try using a rule with the conditions From contains ".
See if that will do the trick. You don't get other emails with " in the sender's name do you?
Filtering spam emails
