Filter on Display Name

[pbard_ironport]

There are two distinct emails that come in at a minimum of four times a day throughout the company. The two display names are

• "NewDishPromotions"
• "ResortGiveAways"

The Full Envelope Sender is below (respectively).

"NewDishPromotions" <Ricky@Spectaculation.ASPENN-SMALL.INFO>
"ResortGiveAways" <Paige@Spectaculation.ASPENN-FLORAL.INFO>

I am attempting to create either a message filter or a content filter on the display name of the envelope sender only as the email and domain content changes constantly with the only portion of the domain remaining unchanged is the .INFO.

My filter:

mail-from == "(?i)NewDishPromotions*"
mail-from == "(?i)ResortGiveAways*"
mail-from == "(?i)\bNewDishPromotions\b"
mail-from == "(?i)\bResortGiveAways\b"

None of the above return a TRUE match when processing through the work queue, either within a message filter or a content filter.

Any assistance would be greatly appreciated.

[shannon.hagan]

Instead of mail-from, try:
header("From") == "(?i)(NewDishPromotions|ResortGiveAways)"

[pbard_ironport]

That seems to be the right filter, hard to test since the Trace feature does not check for the From header. Will have to wait for some additional spam.

YEAH!

[Doc_ironport]

That seems to be the right filter, hard to test since the Trace feature does not check for the From header.

It should, but you need to remember that each email message has 2 different "from" addresses.

The first is the Envelope From address - that's the one that's passed as a part of the SMTP conversation (MAIL FROM: ), and which is what's used in most of the content filters.

The second is the address which is passed in the email headers, and this is the one that the end user actually gets to see - and the one that you're matching when you do a header match on the "From" header as you're doing here.

So to test this in Trace you need to put the from address you want to test into the "body" section of the trace. You can put whatever you in the Envelope Sender field as you're not matching on that, but then in the "Paste Message Body" section put something like :

From: "ResortGiveAways"
Subject: Test
<---- blank link
Spam spam spam!