message filter problem

[evrensevilmisykb]

Hi,

The filter below works very well but when I add OR (sendergroup != "ALLOWSPOOF") part it does not. It begins to quarantine messages.

WORKS-

Spoofed_Email_Filter: if (recv-listener == "IncomingMail") AND ((header-dictionary-match("spoof-domains","From", 1)) AND
(sendergroup != "ALLOWSPOOF")) {
                          insert-header("X-Ironport-Quarantine", "SPOOF
from[$EnvelopeFrom]_To[$EnvelopeRecipients]_IP[$RemoteIP]_rep[$Reputation]");
                          skip-filters();
                      }

DOES NOT WORK-

Spoofed_Email_Filter:
 if (recv-listener == "IncomingMail") AND ((header-dictionary-match("spoof-domains","From", 1)) AND
(sendergroup != "RELAYLIST") OR (sendergroup != "ALLOWSPOOF")) {
                          insert-header("X-Ironport-Quarantine", "SPOOF from[$EnvelopeFrom]_To[$EnvelopeRecipients]_IP[$RemoteIP]_rep[$Reputation]");
                          skip-filters();
                      }

helo
mail from:evren@mailtest.domain.com
rcpt to:evren@evren.gen.tr
data
From:evren@mailtest.domain.com
Subject:testtest
.

quit

[Jacqueline Fleming]

I understand that the 2nd Filter is not working as expected.  However, I'm unsure how that particular example would have matched on your configuration.  So that the community can better help, please reply with the Tracking or mail_logs details for the test emails o we can see exactly which Sender Group it matched on.  Also please let us know if this example should have matched the Filter or not.