You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Filtering spam emails

For the vast majority of spam email I receive, the sender is in quotes. i.e. "SpamJerk". I have tried to create a rule in Mail to filter anything that begins or ends with a quotation mark without success. Any suggestions on how to have the filter recognize this situation?

Posted on Aug 9, 2022 11:16 AM

Reply
Question marked as Top-ranking reply

Posted on Aug 9, 2022 12:09 PM

From: email headers dynamically change to reflect the spam campaign de jure, so attempting to write a single rule to catch them is futile. Wildcards are no supported in Mail rules so "*" won't work. I focus on the Return-Path header field as that is always the mail server used as a transit point which spammers can establish accounts on and forward their originating email through.


In your list of Mail messages, select a single message that you want to filter, then…


In Mail Preferences > Rules, edit your existing rule list, or create a new one. When you click on the default From header field selector, there is a list of alternative fields you can use. At the very bottom of this is is a menu item, Edit Header list… Select that, and add Return-Path to your Header list, exactly as shown. This will now appear near among the selectable items, and select Return-Path. The rule will look like this:


if [any] of the following conditions are met:

[Return-Path] [contains] [ automatically fills in with the return path server address]

Perform the following actions:

[Move Message] to mailbox: [Trash]


In that filled in field on the right above, it will be a long string. Use your arrow key to move to the extreme right of that string, and then start backspacing until you get to the domain name (e.g. @FreshOffThePress.org) and remove everything before that domain name so your rule will act on any email from @FreshOffThePress.org. Once you click OK to save the rule, a dialog will pop open asking to act on the selected email. When you agree, you will see that SPAM disappear from your inbox, and future emails from that Return-Path will automatically get whacked too.

5 replies
Question marked as Top-ranking reply

Aug 9, 2022 12:09 PM in response to t2taylor

From: email headers dynamically change to reflect the spam campaign de jure, so attempting to write a single rule to catch them is futile. Wildcards are no supported in Mail rules so "*" won't work. I focus on the Return-Path header field as that is always the mail server used as a transit point which spammers can establish accounts on and forward their originating email through.


In your list of Mail messages, select a single message that you want to filter, then…


In Mail Preferences > Rules, edit your existing rule list, or create a new one. When you click on the default From header field selector, there is a list of alternative fields you can use. At the very bottom of this is is a menu item, Edit Header list… Select that, and add Return-Path to your Header list, exactly as shown. This will now appear near among the selectable items, and select Return-Path. The rule will look like this:


if [any] of the following conditions are met:

[Return-Path] [contains] [ automatically fills in with the return path server address]

Perform the following actions:

[Move Message] to mailbox: [Trash]


In that filled in field on the right above, it will be a long string. Use your arrow key to move to the extreme right of that string, and then start backspacing until you get to the domain name (e.g. @FreshOffThePress.org) and remove everything before that domain name so your rule will act on any email from @FreshOffThePress.org. Once you click OK to save the rule, a dialog will pop open asking to act on the selected email. When you agree, you will see that SPAM disappear from your inbox, and future emails from that Return-Path will automatically get whacked too.

Aug 11, 2022 7:05 AM in response to Old Toad

Thank you for the response. I had actually tried exactly what you suggest but apparently the rule as shown does not recognize a quotation mark. I tried several variations such as "Begins with", "ends with" with no better success. You are correct, only spam emails include the quotation marks and would have caught 100% of the junk. Limitation of the program?


Thanks again.

Aug 11, 2022 7:29 AM in response to t2taylor

You are welcome.


There can be many spam campaigns using different accounts on the same Return-Path server, or from different Return-Path address servers. If the spammers own their own servers, they may change the domain name in the server address by as little as one letter to cause us to create another rule, and eventually, they may change Return-Path servers too.


I have one Mail rule that has 40 individual Return-Path addresses that are trimmed down to just the specific domain name. Apparently, there are no end to spammers or those that put our email addresses out on the dark web for sale to these miscreants.


At some point (months) I may delete the Mail rule, and see what spam comes in, and eventually I end up with far fewer rule entries as some of the tracked spam sources are no longer sending to me, or as I have noted, using a different Return-Path server.

Filtering spam emails

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.