In a mad moment - Steven Pampling mumbled : > This is typical Outlook Message-ID content: > <9283BA18BE476E4092047448D2FB96FF0938C09C@xxxxxxxxxxxxxxxxxxxxxxxxx> an it > occurs often enough in various spam messages, but the group I'm talking > about have the distinctive $ $ markers This was discussed some while ago under the thread 'Two dollar spam' Here is my UserTest - Mine is ALWAYS Spam - but you may have genuine correspondents who generate this Message ID, in which case I cannot help. WHEN "message-id" user_mid% = 1 st% = LEN(data$) at% = INSTR(data$,"@") IF st% <= 40 THEN IF MID$(data$, 14, 1) = "$" AND MID$(data$, 23, 1) = "$" AND MID$(data$, 32, 1) = "@" THEN UserTestPriority% = 35 exit% = _DELETE% UserTestLog$ = log$ + STR$UserTestPriority% + " * * Msg-ID ·$·$· * *" ENDIF ENDIF Note there are two wrapped line there! -- |) [ |)ryn [vans mail to - antispam@xxxxxxxxxx http://www.bryork.com/antispam - for annotated example Rules file