Try this: In the 'Blocks List' Filter It says 'From' and 'is' Suggest you use 'From' and 'contains' It just seems to get better results.

Usually, I only enter the part after the '@' as sometimes they send emails from same domain but change the first part. So I would use: 'From' and 'contains' and type: mail.pressrun

In Message Filters window - it's worth switching on the 'Filter Log' as it can be useful when trying to work out what's going on. click on 'Filter Log' button select the checkbox 'Enable the filter log' Then close the window.

Thanks for the reply, Toad-Hall!

Interestingly, this morning all three emails got through and I had to manually run the filter, again. One thing I noticed though is that, when I open the Message Filters manager box, the Run selected filter(s) on: drop down option is always defaulted to Choose Folder even though I previously chose Inbox. There's no way to save this option, and I don't know if it even matters.

Per your suggestion, I have changed the 'From' and 'is' to 'From' and 'contains', and also deleted everything prior to mail.pressrundown. For the trivia@ emails shown in my first screenshot, can I also just type in trivia and leave out everything else in hopes that all emails with "trivia" in the sender's address are captured?

I have always had the Filter Log enabled. I'm happy to post the past couple weeks of the results here, or send it to you via PM if that's an option.

All created and enabled Mesage Filters auto run on incoming mail that arrives in the Inbox.

re : One thing I noticed though is that, when I open the Message Filters manager box, the Run selected filter(s) on: drop down option is always defaulted to Choose Folder even though I previously chose Inbox

Usually, it defaults to whatever folder you have selected in the mail account prior to opening Message Filters. In your case - select 'Inbox' before opening Message Filters. But if you have selected the mail account name folder in the Folder Pane then it will ask 'Choose folder' because no folder has been selected.

re: Usually, it defaults to whatever folder you have selected in the mail account prior to opening Message Filters. In your case - select 'Inbox' before opening Message Filters. But if you have selected the mail account name folder in the Folder Pane then it will ask 'Choose folder' because no folder has been selected.

I see that now...thanks!

I looked at the Filter Log results, but from what I can tell it's only showing that the subject emails were deleted (which I did manually via Run Now), not that they were automatically deleted. I'll give this a day or two to see if the changes you recommended in your first reply make a difference and post an update then.

There are two killer things with filter execution.

1. Unless you are marking the message as junk/not junk, change the action to after junk classification. This delays the execution slightly and often relieves issues with timing, especially with IMAP mail accounts.

2. Ensure your installed antivirus is not scanning in the Thunderbird mail profile. Recently I had defender go mad and none of my filters were working because it had the files held up while it scanned them post the adding of the latest mail. The mail is added, the filter executes and the file is not there to update. A simple exclusion for the mail and IMAP mail folders in defender fixed that issue. I have also seen the antivirus cause junk mail to remain in the inbox because again the file is locked for scanning when it is needed for update.

Matt, thanks for the recommendations.

At your suggestion I changed the action to "after junk classification" a couple days ago, but unfortunately all three filters in the Blocks List failed again this morning. When I clicked 'Tools > Run Filters on Folder', they went bye-bye. It's just not happening automatically.

I have not, however, excluded my antivirus and Defender from scanning the mail and IMAP folders, if that is what you meant. Unless I'm misinterpreting what you suggest, I'm reluctant to do so since a lot of potential malware and virus threats can reach all of us via email, and I like the protection I think they provide. Wouldn't excluding those files from virus/malware scans potentially open them up to security breaches? If I'm misconstruing your recommendation, would you please clarify for me what you mean?

re :I have not, however, excluded my antivirus and Defender from scanning the mail and IMAP folders, if that is what you meant. That is correct.

re :I'm reluctant to do so since a lot of potential malware and virus threats can reach all of us via email, and I like the protection I think they provide.

Thunderbird by default does not allow 'Remote Content' unless you have selected to display it, which given your previous response, I would believe to be unlikely. Recommend you do not allow remote content.

I would also suggest you do not have this auto enabled : 'View' > 'Display Attachments in line'

Do not click on any links until you have verified the link is legit. Hover over the link and the real link gets displayed in the bottom status bar, so you can read it.

Do not click on attachments unless you know it is legit and you know who sent it. Most virus malware which comes via an email only gets only your computer if you choose to do something which you should not do. eg: Let curiousity get the better of you and click on links and attachments that you have no idea who sent them or what they are about.

It's quite simple to follow simple basic rules and if you do then you will not have a problem. Thunderbird is designed to be more secure than you think. Maleware/Virus do not get into your computer just because there is a bad attachment in an email. The sender requires you to actually choose to open that attachment - they want you to be curious, they hope you are not sensible enough to just delete the email and then compact the folder to remove all traces.

You would be amazed how frequently an AV or Cleanup software causes issues because they intervene the process. There is only one way you are going to know they are not the problem and until you test it, tou will not know.

Please add exceptions and do not allow scanning of profile folders.

Toad-Hall,

Thanks for clarifying what you and Matt suggested above.

As I already practice all the email safety recommendations in your previous reply, I guess I've been overly paranoid regarding any potential threats by having my AV continue to scan the TB mail profile. Having said that, what particular files should be excluded and where do I find them? I found three different instances of TB folders (in Program Files x86, and in AppData Roaming and Local folders). Should I just exclude (or "allow"--see below) all TB folders/files?

Also, my AV is Malwarebytes Premium, and from what I can tell, it has an "Allow List" for websites and files, but no "Exclusions" list for apps. Dumb question, but are those considered one and the same?

Thanks again for all the help!

re: Program Files x86, This is the location of the actual Thunderbird program. Program Files (x86)/Mozilla Thunderbird/thunderbird.exe Your Firewall should have the Thunderbird program set as allowed

re: in AppData Roaming This is the location of your thunderbird profile folders. This is were all your emails, mail accounts, address books etc etc etc are stored. Users/User name/ Appdata/Roaming/Thunderbird This is the folder you want to exempt from scanning it and its subfolders. Note: when you want to create a backup, this is the 'Thunderbird' folder you need to copy. Please make sure to exit Thunderbird first.

re: AppData Local This location is used by the Windows OS as a cache location to aid when program is in use. It does not contain any emails and does not need to be backed up.

re :"Allow List" for websites and files, but no "Exclusions" list for apps. Dumb question, but are those considered one and the same?

apps are programs which are installed on your computer eg: Thunderbird. Programs contain files and folders which contain all the necessary code to make the program work. In the case of thunderbird, it has a 'thunderbird.exe' file which when selected to run is the program and it may use other files and folders to support functionality.

Websites are not programs running on your computer. A browser is a program installed on your computer eg: Mozilla Firefox, Microsoft Edge You use a browser to access and search what is available on the internet. EG: this thunderbird support forum. This thunderbird support forum is a website. So anything like the following are examples of websites: https://support.mozilla.org/en-US/questions/1414260? http://www.anje.co.uk

Thanks for pointing me to the correct folder for exempting from scanning. The thing that confused me was that there are Thunderbird Profile folders in both AppData Roaming and Local locations. Thanks for explaining the difference between Roaming and Local...now I know!

Re: apps and programs, folders/files, websites and browsers; you couldn't have known from my poorly worded question that I'm aware of what these are. What I meant was, in Malwarebytes there doesn't appear to be an "exemptions" list to keep it from scanning certain websites, programs (apps), files or folders. It does, however, have an "Allow List", and I was trying to ask if they (exemptions list/allow list) are one and the same. I'm gonna go out on a limb and guess they are, so I've added the Users/User name/ Appdata/Roaming/Thunderbird folder to it (see image).

I get the emails mentioned in my original post once daily, and I've already manually run the Blocks List filter today. Hopefully the filter will run automatically now that I've added the TB profile folder to my AV program. Will return tomorrow with an update!

Some things to try

• rather than using an action of delete, try an action of move the message to the Trash folder in "Local Folders"
• make sure the failing address does not have trailing or leading spaces.
• try putting the addresses in their own address book, and change the match criteria to "is in my address book" XXXX

UPDATE:

After ensuring my Malwarebytes AV and Windows Defender are excluded from scanning the profile folder in TB, I've waited a couple days to see if there was any change to the filtering behavior. Both yesterday and this morning I noted that the trivia email was deleted automatically but as usual, the pressrundown email got through and had to be filtered manually.

Next test will be following @Wayne Mery's suggestions in the post prior to this one. I set up a new address book specifically for the addresses I want to block (currently only the pressrundown one is in it since the trivia emails are already filtering automatically) and changed the match criteria as Wayne recommended. I also changed the delete action to move the message to the Trash folder in "Local Folders" .

Thanks for the help, everyone! I'll report back in the next couple days with the latest results.

Well, nothing is working so far. Sometimes the 'trivia' email gets auto-filtered, other times not. The 'pressrundown' email always gets through. Both can be manually filtered using the 'Run Filters on Folder' command in 'Tools'.

I've tried everything everyone above has suggested, and the TB profile folder is still excepted from scanning in my AV and Defender. I have no active Cleanup software (I only run it manually; it is not set up to auto-clean, nor does it load at Startup).

I was hopeful that putting the 'pressrundown' email address in its own address book and changing the match criteria to "is in my address book" as @Wayne suggested above would work, but alas, it didn't. How is it possible for it to get through that? It just doesn't make sense. Either the sender(s) have a way to circumvent the filters in TB or I'm (we're) still missing something.

Not sure if this will work, but I just added the offending email addresses to the "Blocked Addresses" list after directly logging into the web version of the email account. Prior to me setting up TB a few years ago, I had added about 60 addresses to the list and none have gotten through since, so hopefully that will do the trick.

If there's more to the story, there will be film at 11.

Please select a 'pressrundown' email to view in Message Pane click on 'More' and select 'View Source'

Please post an image showing all the headers - blank out only where it shows your email address.

Here is the screenshot you asked me to post. Please let me know if you need to see more of my pane in another image.

Two full days without either email getting through to TB since I blocked the addresses in the web version of my email account. I double checked the TB Filter Log to verify no activity has taken place since 6/11.

Sorry, but I need to see all the headers - everything above the actual content of the email itself. So from the top all the way down to and including where it says the 'From, TO, DAte, Subject

Like this?

That's the header section displayed in the Message Pane when you open an email, but it's not all the headers as shown in the 'View Source'.

I'm trying to see if there is a different from mentioned in the full headers.

The ip address 156.70.72.133 seems to belong to SparkPost an email delivery service provider and pressrundown.com seems to be using them for sending emails.

Try adding this to Block List filter: 'From' 'contains' sparkpostmail

but it should have picked up: 'From' 'contains' pressrundown make sure there is no hidden blank space after eg: pressrundown

Obviously you'll only know if it's working if you allow in webmail filter.

When you do all the above to test, it would also be worth post an image of the filter log to see if there's any info on why filter did not work on that occasion.

re: That's the header section displayed in the Message Pane when you open an email, but it's not all the headers as shown in the 'View Source'.

I apologize, but I guess I'm not understanding what you need. Would you mind posting an example image so I provide what you're looking for?

re: Try adding this to Block List filter: 'From' 'contains' sparkpostmail

I will unblock pressrundown in webmail and add this filter to TB, and provide results in the next day or so.

re: it would also be worth post an image of the filter log to see if there's any info on why filter did not work on that occasion.

I'm happy to provide this, but since there won't be any info for a non-filtered message, and if the filter doesn't happen automatically, should I manually run it and then post those results? I want to make sure I'm posting the data you need.

I've attached an image of the last few filtered messages as it was set up back on 6/11 and prior. They were all manually filtered as the auto-filter didn't work.

Here's the latest:

A couple days ago I unblocked pressrundown in webmail and added sparkpostmail to the TB Block List filter as suggested. This morning the pressrundown email dropped into my inbox on TB. I tried manually filtering it (clicked on 'Run Now') and nothing happened. I checked the filter log and it hasn't changed from the one in my last post, above.

Looking in 'View Source' for the pressrundown emails, I noticed the email delivery provider (SparkPost) is shown as @sparkpostmail2.com so I added the '2' to the end of sparkpostmail in the Block List filter and tried manually running it again. Nothing happened.

There are a several differences in the 'View Source' panes of the emails as shown in the image attached. I don't know if they're relevant or not.

Just curious, but why can't TB actually block senders like some webmail providers do?