In Filter: Do you have this...

select :'Filter before Junk Classification' select 'Match all of the following'

'From' and 'isn't in my address book' and select the name of the address book eg: Personal Address Book.

If you want to select more than one address book: select: 'Match any of the following' click on small + sign a new line will appear allowing you to add another address book. 'From' and 'isn't in my address book' and select the name of the address book eg: Collected addresses

Perform these actions: ' Set Junk status to' and select 'Junk' click on small + sign 'Move Message to' and select the 'Junk' folder. click on OK

Move this filter up to the top of the list, so it runs first.

Toad-Hall, Many, many thanks for your suggestion. It took me awhile to add all of my newsletters and ads to this contact list, but the result was worth it - greatly reduced spam.

I say "greatly reduced" because some spam still leaks through. That happens when the sender will spoof their address, changing it to be my actual assigned e-mail address! Thunderbird then assumes I sent the e-mail to myself, so doesn't consider it spam (although sometimes it does). Is there a way to get around this spammer's trick?

As a note, when I ask to "view source", this spam seems to be coming from "p1-183127.mail.markandgraham.com". I've gotten several of these spoofing spam messages from that domain. That domain is the last of the "Received:" lines near the top. Does Thunderbird have any provision for digging down to get that domain?

You can customize in the filter dialog to add the header field "received:" and then test on that field with a contained.

I have not done it and really do not know how Thunderbird filters headers where there are multiple occurrences. It might only check on the first occurrence it sees. My experiences have been on headers that only appear once, like X-YahooFilteredBulk and Message-ID

Thanks for that information Matt - it seemed like a great idea!

So I immediately tried it, but ran into problems. First off, the colon in "Received:" was rejected, so I had to eliminate it. But even then the filter didn't do the job.

When setting up this filter, I selected the Subject "Customize". The form "Customize Headers" then appeared. I assume "Headers" means the lines of text that appear when, in Thunderbird, I click on "More" and then "View Source". Is that right? In my case, there are four of these "Received: " lines. I want the fourth (last) line. So, yes, I agree that there is an issue as to whether the filter algorithm selects only the first, or every "Received: " line.

So, I guess we need some Thunderbird filter expert to advise us if these "View Source" lines refer to "Header", and if processing takes place on all of these header lines or only the first one it finds.

Got it to work! After a bit of investigation.

Seems like "Headers" really DOES refer to the lines you see when clicking on "More", then "View Source". Great!

My mistake was that when setting up the filter for "Received", I had left the default to "Match all of the following", and of course my target text was not in ALL of the "Received" lines. So I instead selected "Match any of the following". I tested it by moving the spam e-mail to a test folder, and then to my "Inbox", and the filter worked just as expected.

So now I can get rid of those sneaky spoofed spam e-mails!

The e-mail filtering options work great, once you know how to use them!