It was quite correct. The "Delete From: @domaincaps" rule rejected apparent spam with "Subject: Delivery Status" . The From: was "From: <>". Unexpected but logical, there is, however, a potential for false positives. -- Dave Keep GMT all year