> > I think there's a spurious CRLF inside the mail header, before the "From:" > > line. This causes the origin to be POSTMASTER@yourfqdn and *that* trips the > > built-in filter. > > Hmm... if that were the case, would the "forwarded message" part still show > the From:/To:/et? Hard to tell because you edited it :-) Anyway it's the only explanation I could think of because I too reviewed the built-in filter and found no match. Unless there is a "Sender:" but spammers seldom do that. Eric ############################ To unsubscribe from the LSTSRV-L list: write to: mailto:[log in to unmask] or click the following link: http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1